Loading npm security reports…

@sallyhuang/agent-notify@1.0.3: Malicious npm security report | LPM Firewall

registry / @sallyhuang/agent-notify / 1.0.3

@sallyhuang/agent-notify@1.0.3

Native macOS notifications for AI coding agents

AI Security Review

scanned 1h ago · by lpm-firewall-ai

On npm installation, the package silently installs behavior-bearing skills into four unrelated user-level AI-agent control surfaces. It enables implicit invocation for Codex and can download and install an unchecked release app.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install executes postinstall automatically.

Impact

A dependency installation can alter multiple AI agents' behavior and replace a user application without an explicit setup command.

Mechanism

Postinstall mutation of agent skill directories plus unchecked remote app installation.

Attack narrative

Installing the package automatically runs its postinstall hook. That hook copies a skill into global directories for several AI-agent products; the copied Codex configuration permits implicit invocation. The same hook removes and replaces the user's application bundle, and on non-ARM systems downloads a release archive selected through an environment variable while accepting redirects and performing no integrity check. These actions are not gated behind an explicit user setup command.

Rationale

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces, coupled with replacement and unchecked remote acquisition of an executable application. The behavior meets the install-hook abuse blocking boundary.

Evidence

package.jsonscripts/npm-install.jsskills/agent-notify/agents/openai.yaml$HOME/.agents/skills/agent-notify$HOME/.codex/skills/agent-notify$HOME/.claude/skills/agent-notify

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/agent-notify.jsView file

4const path = require("path"); L5: const { spawnSync } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

bin/agent-notify.jsView on unpkg · L4

scripts/npm-install.jsView file

49if (architecture === "arm64" && fs.existsSync(path.join(bundledApp, "Contents", "MacOS", "AgentNotify"))) { L50: fs.mkdirSync(path.dirname(appDestination), { recursive: true }); L51: fs.rmSync(appDestination, { recursive: true, force: true }); L52: fs.cpSync(bundledApp, appDestination, { recursive: true }); L53: console.log("Installed the bundled Apple Silicon AgentNotify.app."); ... L66: if (!fs.existsSync(extracted)) throw new Error("release archive did not contain AgentNotify.app"); L67: fs.mkdirSync(path.dirname(appDestination), { recursive: true }); L68: fs.rmSync(appDestination, { recursive: true, force: true }); L69: fs.cpSync(extracted, appDestination, { recursive: true }); L70: } finally { ... L76: const source = path.join(packageRoot, "skills", "agent-notify"); L77: for (con

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/npm-install.jsView on unpkg · L49

3const fs = require("fs"); L4: const https = require("https"); L5: const os = require("os"); L6: const path = require("path"); L7: const { execFileSync } = require("child_process"); L8: ... L13: const architecture = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null; L14: const releaseTag = process.env.AGENT_NOTIFY_RELEASE_TAG || `v${packageJson.version}`; L15: const repository = "sally1913105/AgentNotify";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/npm-install.jsView on unpkg · L3

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. exit(1); } if (!architecture) { console.error(`unsupported macos cpu architecture: ${process.arch}`); process.exit(1); } function download(url, destination) { return new promise((resolve, reject) => { https.get(url, response => { if ([301, 302, 307, 308].includes(response.statuscode) && response.headers.location) { response.resume(); download(response.headers.location, destination).then(resolve, reject); return; } if (response.statuscode !== 200) { response.resume(); reject(new error(`download failed with http ${response.statuscode}`)); return; } const file = fs.createwritestream(destination

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/npm-install.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @sallyhuang/agent-notify@1.0.2 matchedPath = scripts/npm-install.js matchedIdentity = npm:[redacted]:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e212457d80eb460c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @sallyhuang/agent-notify@1.0.2 matchedPath = scripts/npm-install.js matchedIdentity = npm:[redacted]:1.0.2 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/npm-install.jsView on unpkg

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView file

•path = prebuilt/AgentNotify.app/Contents/MacOS/AgentNotify kind = native_binary sizeBytes = 344528 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView on unpkg