Loading npm security reports…

@sallyhuang/agent-notify@1.0.1: AI-agent control-surface risk | LPM Firewall

registry / @sallyhuang/agent-notify / 1.0.1

@sallyhuang/agent-notify@1.0.1

Native macOS notifications for AI coding agents

AI Security Review

scanned 5h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies several user-wide AI-agent skill control surfaces. It also installs a bundled or remotely downloaded native application into the user's Applications directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

Affected agents can receive a package-authored default prompt without an explicit setup command; Intel installs execute an unverified downloaded application bundle.

Mechanism

Postinstall copies an implicitly invokable skill into multiple agent directories and installs a native app.

Policy narrative

During npm installation, the postinstall script copies a package-provided skill into global directories for multiple unrelated AI-agent products. The skill allows implicit invocation and injects a default prompt. The same hook replaces an application under the user's Applications directory; for Intel systems it downloads a release archive selected by an environment-controlled tag, extracts it, and installs it without source verification. This is unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

The automatic postinstall hook mutates several foreign, user-wide agent skill directories and enables implicit package-authored behavior. The remote native-app installation further increases the install-time supply-chain attack surface.

Evidence

package.jsonscripts/npm-install.jsskills/agent-notify/agents/openai.yamlskills/agent-notify~/.agents/skills/agent-notify~/.codex/skills/agent-notify

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/agent-notify.jsView file

4const path = require("path"); L5: const { spawnSync } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

bin/agent-notify.jsView on unpkg · L4

scripts/npm-install.jsView file

49if (architecture === "arm64" && fs.existsSync(path.join(bundledApp, "Contents", "MacOS", "AgentNotify"))) { L50: fs.mkdirSync(path.dirname(appDestination), { recursive: true }); L51: fs.rmSync(appDestination, { recursive: true, force: true }); L52: fs.cpSync(bundledApp, appDestination, { recursive: true }); L53: console.log("Installed the bundled Apple Silicon AgentNotify.app."); ... L66: if (!fs.existsSync(extracted)) throw new Error("release archive did not contain AgentNotify.app"); L67: fs.mkdirSync(path.dirname(appDestination), { recursive: true }); L68: fs.rmSync(appDestination, { recursive: true, force: true }); L69: fs.cpSync(extracted, appDestination, { recursive: true }); L70: } finally { ... L76: const source = path.join(packageRoot, "skills", "agent-notify"); L77: for (con

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/npm-install.jsView on unpkg · L49

3const fs = require("fs"); L4: const https = require("https"); L5: const os = require("os"); L6: const path = require("path"); L7: const { execFileSync } = require("child_process"); L8: ... L13: const architecture = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null; L14: const releaseTag = process.env.AGENT_NOTIFY_RELEASE_TAG || `v${packageJson.version}`; L15: const repository = "sally1913105/AgentNotify";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/npm-install.jsView on unpkg · L3

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. exit(1); } if (!architecture) { console.error(`unsupported macos cpu architecture: ${process.arch}`); process.exit(1); } function download(url, destination) { return new promise((resolve, reject) => { https.get(url, response => { if ([301, 302, 307, 308].includes(response.statuscode) && response.headers.location) { response.resume(); download(response.headers.location, destination).then(resolve, reject); return; } if (response.statuscode !== 200) { response.resume(); reject(new error(`download failed with http ${response.statuscode}`)); return; } const file = fs.createwritestream(destination

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/npm-install.jsView on unpkg

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView file

•path = prebuilt/AgentNotify.app/Contents/MacOS/AgentNotify kind = native_binary sizeBytes = 344528 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView on unpkg