Loading npm security reports…

@screenata/cli@0.5.6: AI-agent control-surface risk | LPM Firewall

registry / @screenata/cli / 0.5.6

@screenata/cli@0.5.6

Screenata CLI — compliance workflows from your terminal

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically creates and links or overwrites AI-agent skill files. It targets detected Claude Code, Codex, OpenCode, and OpenClaw installations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

An install can alter AI-agent instruction surfaces in the user's home directory without an explicit setup command.

Mechanism

silent cross-agent skill installation

Policy narrative

The package's postinstall hook imports dist/postinstall.js. That code detects multiple installed AI coding agents, creates a canonical skill file, then symlinks or copies it into each detected agent's skill directory. It executes silently during installation rather than through the documented init command, altering broad, third-party AI-agent control surfaces without consent.

AI rationale

This is an unconsented install-time mutation of foreign AI-agent instruction directories. The lifecycle hook directly performs the change and suppresses errors, making it concrete install-hook abuse.

Evidence

package.jsondist/postinstall.js~/.agents/skills/screenata/SKILL.md~/.claude/skills/screenata/SKILL.md$CODEX_HOME/skills/screenata/SKILL.md~/.config/opencode/skills/screenata/SKILL.md~/.openclaw/skills/screenata/SKILL.md

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const p='./dist/postinstall.js';require('fs').existsSync(p)&&import(p)"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const p='./dist/postinstall.js';require('fs').existsSync(p)&&import(p)"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli.jsView file

175async function performUpgrade(latest) { L176: const { execSync } = await import("child_process"); L177: console.log(`

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L175

13143eps: "PostScript", L13144: ps1: "PowerShell", L13145: psd1: "PowerShell",

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L13143

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs"; import { createInterface } from "readline"; writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 }); import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs"; writeFileSync2(CONFIG_PATH, lines.join(` Authorization: `Bearer ${this.config.accessToken}`, Authorization: `Bearer ${this.config.accessToken}`, var fs$writeFile = fs4.writeFile;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

166upgraded: false, L167: hint: `npm install -g @screenata/cli@${latest}` L168: }, null, 2)); ... L175: async function performUpgrade(latest) { L176: const { execSync } = await import("child_process"); L177: console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L166

•matchType = normalized_sha256 matchedPackage = @screenata/cli@0.5.5 matchedPath = dist/cli.js matchedIdentity = npm:QHNjcmVlbmF0YS9jbGk:0.5.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = dd1aff8082b3f155 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @screenata/cli@0.5.5 matchedPath = dist/cli.js matchedIdentity = npm:QHNjcmVlbmF0YS9jbGk:0.5.5 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

3914if (typeof callback !== "function") { L3915: callback = new Function("" + callback); L3916: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L3914

dist/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @screenata/cli@0.5.5 matchedPath = dist/postinstall.js matchedIdentity = npm:QHNjcmVlbmF0YS9jbGk:0.5.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/postinstall.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "@screenata/cli",

3 "version": "0.5.6",

4 "description": "Screenata CLI — compliance workflows from your terminal",

5 "type": "module",

6 "license": "MIT",

7 "author": "DeepGuide AI <support@deepguide.ai>",

8 "bin": {

9 "screenata": "bin/screenata.js"

10 },

11 "files": [

12 "bin",

13 "dist",

14 "README.md"

15 ],

16 "scripts": {

17 "build": "bun build ./src/cli.ts --outfile ./dist/cli.js --target node && bun build ./src/postinstall.ts --outfile ./dist/postinstall.js --target node",

18 "dev": "bun run ./src/cli.ts",

19 "test": "vitest run",

20 "generate:public-skill": "bun run ./scripts/generate-public-skill.ts",

21 "postinstall": "node -e \"const p='./dist/postinstall.js';require('fs').existsSync(p)&&import(p)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L21

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

22 "prepack": "bun run build"

23 },

24 "//deps": "`bun build` inlines everything into dist/ — the only bare specifiers left in the bundle are node builtins. So these are BUILD-time deps, and the published package has no runtime dependencies. Keeping the two `workspace:*` entries under `dependencies` shipped them verbatim to npm (npm publish, unlike pnpm publish, does not rewrite the workspace protocol), and `@deepguide-ai/types` is not on npm at all — so 0.5.0 and 0.5.1 fail to install with EUNSUPPORTEDPROTOCOL. Do not move these back.",

25 "devDependencies": {

26 "@deepguide-ai/types": "workspace:*",

27 "@screenata/codebase-compliance": "workspace:*",

28 "jszip": "^3.10.1",

29 "open-evidence-signing": "workspace:*",

30 "typescript": "^5.9.0",

31 "vitest": "^3.2.6"

32 }

33}

34

dist/cli.jsView file

175async function performUpgrade(latest) { L176: const { execSync } = await import("child_process"); L177: console.log(`

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L175

13143eps: "PostScript", L13144: ps1: "PowerShell", L13145: psd1: "PowerShell",

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L13143

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs"; import { createInterface } from "readline"; writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 }); import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs"; writeFileSync2(CONFIG_PATH, lines.join(` Authorization: `Bearer ${this.config.accessToken}`, Authorization: `Bearer ${this.config.accessToken}`, var fs$writeFile = fs4.writeFile;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

166upgraded: false, L167: hint: `npm install -g @screenata/cli@${latest}` L168: }, null, 2)); ... L175: async function performUpgrade(latest) { L176: const { execSync } = await import("child_process"); L177: console.log(`

dist/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @screenata/cli@0.5.5 matchedPath = dist/postinstall.js matchedIdentity = npm:QHNjcmVlbmF0YS9jbGk:0.5.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/postinstall.jsView on unpkg