@sallyhuang/agent-notify@1.0.4: AI-agent control-surface risk

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies global skill directories for four AI-agent products. It also installs or replaces a native application in the user's Applications directory and may download a release archive.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

An install can introduce implicitly invokable agent instructions across Codex, Claude, Cursor, and generic agent skill surfaces without user setup consent.

Mechanism

Automatic global AI-agent skill installation and native app deployment

Policy narrative

When npm installs this package, its postinstall script deploys a native application and copies the packaged skill into four global AI-agent skill roots. The Codex skill allows implicit invocation, so the install changes multiple agent control surfaces without a separate user-directed setup action. Intel installations download and unpack a release archive before replacing the installed application.

Rationale

The automatic postinstall mutation of broad, foreign AI-agent control surfaces is a concrete malicious install-hook abuse under the policy. The absence of visible credential theft does not neutralize that unconsented lifecycle behavior.

Evidence

package.jsonscripts/npm-install.jsskills/agent-notify/agents/openai.yamlskills/agent-notifyprebuilt/AgentNotify.app$HOME/Applications/AgentNotify.app$HOME/.agents/skills/agent-notify$HOME/.codex/skills/agent-notify$HOME/.claude/skills/agent-notify$HOME/.cursor/skills/agent-notify

Network endpoints1

github.com/sally1913105/AgentNotify/releases/download/${releaseTag}/${asset}

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs its installer through a postinstall lifecycle hook.
The installer copies a skill into four global agent-control directories under the user's home directory without an explicit setup command.
The installer replaces a home-directory app bundle and downloads an architecture-specific release archive before copying it into place.
The installed Codex skill permits implicit invocation and supplies a default prompt.

Evidence against

No source code reads environment secrets, credentials, or arbitrary user files.
The only source-visible network target is the package's GitHub release URL.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.48 KB of source, external domains: github.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "@sallyhuang/agent-notify",

3 "version": "1.0.4",

4 "description": "Native macOS notifications for AI coding agents",

5 "license": "MIT",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/sally1913105/AgentNotify.git"

9 },

10 "homepage": "https://github.com/sally1913105/AgentNotify",

11 "bin": {

12 "agent-notify": "bin/agent-notify.js"

13 },

14 "scripts": {

15 "postinstall": "node scripts/npm-install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 },

17 "files": [

18 "bin",

19 "skills",

20 "prebuilt/AgentNotify.app",

21 "scripts/npm-install.js",

22 "README.md",

23 "LICENSE"

24 ],

25 "os": [

26 "darwin"

27 ],

28 "engines": {

29 "node": ">=18"

30 }

31}

32

bin/agent-notify.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const os = require("os");

4const path = require("path");

5const { spawnSync } = require("child_process");

6

High

Child Process

Package source references child process execution.

bin/agent-notify.jsView on unpkg · L4

7const app = path.join(os.homedir(), "Applications", "AgentNotify.app");

8const executable = path.join(app, "Contents", "MacOS", "AgentNotify");

9const args = process.argv.slice(2);

10

11if (!require("fs").existsSync(executable)) {

12 console.error("AgentNotify.app is not installed. Re-run npm install for this package.");

13 process.exit(1);

14}

15

16const result = spawnSync(executable, args, { stdio: "inherit" });

17if (result.error) {

18 console.error(`agent-notify: ${result.error.message}`);

19 process.exit(1);

20}

21process.exit(result.status === null ? 1 : result.status);

22

scripts/npm-install.jsView file

Lines 1-69javascript

1#!/usr/bin/env node

2

3const fs = require("fs");

4const https = require("https");

5const os = require("os");

6const path = require("path");

7const { execFileSync } = require("child_process");

8

9const packageRoot = path.resolve(__dirname, "..");

10const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));

11const home = os.homedir();

12const appDestination = path.join(home, "Applications", "AgentNotify.app");

13const architecture = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null;

14const releaseTag = process.env.AGENT_NOTIFY_RELEASE_TAG || `v${packageJson.version}`;

15const repository = "sally1913105/AgentNotify";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/npm-install.jsView on unpkg · L3

16

17if (process.platform !== "darwin") {

18 console.error("AgentNotify requires macOS.");

19 process.exit(1);

20}

21if (!architecture) {

22 console.error(`Unsupported macOS CPU architecture: ${process.arch}`);

23 process.exit(1);

29 if ([301, 302, 307, 308].includes(response.statusCode) && response.headers.location) {

30 response.resume();

31 download(response.headers.location, destination).then(resolve, reject);

32 return;

33 }

34 if (response.statusCode !== 200) {

35 response.resume();

36 reject(new Error(`download failed with HTTP ${response.statusCode}`));

37 return;

38 }

39 const file = fs.createWriteStream(destination);

40 response.pipe(file);

41 file.on("finish", () => file.close(resolve));

42 file.on("error", reject);

43 }).on("error", reject);

44 });

45}

46

47async function installApp() {

48 const bundledApp = path.join(packageRoot, "prebuilt", "AgentNotify.app");

49 if (architecture === "arm64" && fs.existsSync(path.join(bundledApp, "Contents", "MacOS", "AgentNotify"))) {

50 fs.mkdirSync(path.dirname(appDestination), { recursive: true });

51 fs.rmSync(appDestination, { recursive: true, force: true });

52 fs.cpSync(bundledApp, appDestination, { recursive: true });

53 console.log("Installed the bundled Apple Silicon AgentNotify.app.");

54 return;

55 }

56

57 const asset = `AgentNotify-macos-${architecture}.zip`;

58 const url = `https://github.com/${repository}/releases/download/${releaseTag}/${asset}`;

59 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "agent-notify-"));

60 const archive = path.join(tempRoot, asset);

61 try {

62 console.log(`Downloading ${asset} from ${repository} (${releaseTag})...`);

63 await download(url, archive);

64 execFileSync("/usr/bin/ditto", ["-x", "-k", archive, tempRoot], { stdio: "inherit" });

65 const extracted = path.join(tempRoot, "AgentNotify.app");

66 if (!fs.existsSync(extracted)) throw new Error("release archive did not contain AgentNotify.app");

67 fs.mkdirSync(path.dirname(appDestination), { recursive: true });

68 fs.rmSync(appDestination, { recursive: true, force: true });

69 fs.cpSync(extracted, appDestination, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/npm-install.jsView on unpkg · L49

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. exit(1); } if (!architecture) { console.error(`unsupported macos cpu architecture: ${process.arch}`); process.exit(1); } function download(url, destination) { return new promise((resolve, reject) => { https.get(url, response => { if ([301, 302, 307, 308].includes(response.statuscode) && response.headers.location) { response.resume(); download(response.headers.location, destination).then(resolve, reject); return; } if (response.statuscode !== 200) { response.resume(); reject(new error(`download failed with http ${response.statuscode}`)); return; } const file = fs.createwritestream(destination

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/npm-install.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @sallyhuang/agent-notify@1.0.3 matchedPath = scripts/npm-install.js matchedIdentity = npm:[redacted]:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e212457d80eb460c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @sallyhuang/agent-notify@1.0.3 matchedPath = scripts/npm-install.js matchedIdentity = npm:[redacted]:1.0.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/npm-install.jsView on unpkg

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView file

•path = prebuilt/AgentNotify.app/Contents/MacOS/AgentNotify kind = native_binary sizeBytes = 364464 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/npm-install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/agent-notify.jsView file

4const path = require("path"); L5: const { spawnSync } = require("child_process"); L6:

High

Child Process

Package source references child process execution.

bin/agent-notify.jsView on unpkg · L4

scripts/npm-install.jsView file

49if (architecture === "arm64" && fs.existsSync(path.join(bundledApp, "Contents", "MacOS", "AgentNotify"))) { L50: fs.mkdirSync(path.dirname(appDestination), { recursive: true }); L51: fs.rmSync(appDestination, { recursive: true, force: true }); L52: fs.cpSync(bundledApp, appDestination, { recursive: true }); L53: console.log("Installed the bundled Apple Silicon AgentNotify.app."); ... L66: if (!fs.existsSync(extracted)) throw new Error("release archive did not contain AgentNotify.app"); L67: fs.mkdirSync(path.dirname(appDestination), { recursive: true }); L68: fs.rmSync(appDestination, { recursive: true, force: true }); L69: fs.cpSync(extracted, appDestination, { recursive: true }); L70: } finally { ... L76: const source = path.join(packageRoot, "skills", "agent-notify"); L77: for (con

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/npm-install.jsView on unpkg · L49

3const fs = require("fs"); L4: const https = require("https"); L5: const os = require("os"); L6: const path = require("path"); L7: const { execFileSync } = require("child_process"); L8: ... L13: const architecture = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "x64" : null; L14: const releaseTag = process.env.AGENT_NOTIFY_RELEASE_TAG || `v${packageJson.version}`; L15: const repository = "sally1913105/AgentNotify";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/npm-install.jsView on unpkg · L3

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. exit(1); } if (!architecture) { console.error(`unsupported macos cpu architecture: ${process.arch}`); process.exit(1); } function download(url, destination) { return new promise((resolve, reject) => { https.get(url, response => { if ([301, 302, 307, 308].includes(response.statuscode) && response.headers.location) { response.resume(); download(response.headers.location, destination).then(resolve, reject); return; } if (response.statuscode !== 200) { response.resume(); reject(new error(`download failed with http ${response.statuscode}`)); return; } const file = fs.createwritestream(destination

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/npm-install.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @sallyhuang/agent-notify@1.0.3 matchedPath = scripts/npm-install.js matchedIdentity = npm:[redacted]:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/npm-install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e212457d80eb460c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @sallyhuang/agent-notify@1.0.3 matchedPath = scripts/npm-install.js matchedIdentity = npm:[redacted]:1.0.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/npm-install.jsView on unpkg

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView file

•path = prebuilt/AgentNotify.app/Contents/MacOS/AgentNotify kind = native_binary sizeBytes = 364464 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilt/AgentNotify.app/Contents/MacOS/AgentNotifyView on unpkg

Findings

1 Critical6 High4 Medium3 Low

CriticalAi Agent Control Hijackscripts/npm-install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/agent-notify.js

HighSame File Env Network Executionscripts/npm-install.js

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/npm-install.js

HighKnown Malware Source Similarityscripts/npm-install.js

HighKnown Malware Source Fingerprint Signaturescripts/npm-install.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryprebuilt/AgentNotify.app/Contents/MacOS/AgentNotify

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings