@shuv1337/shuvgrok@1.0.4: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@shuv1337/shuvgrok@1.0.4: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

25"scripts": { "postinstall": "node bin/postinstall.js" }

High

Suspicious Lifecycle Evidence

package.json runs bin/postinstall.js automatically on npm install.

package.jsonView on unpkg · L25

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

9// The binary is deliberately named `shuvgrok`, not `grok`: ~/.grok is shared // with an upstream @xai-official/grok install, and a `grok` symlink there // would collide with it. Only the config file path stays `~/.grok/config.toml` // (read by the Rust side, which is unchanged in this fork).

High

Suspicious Lifecycle Evidence

postinstall selects ~/.grok, documented in source as shared with upstream @xai-official/grok.

bin/postinstall.jsView on unpkg · L9

71fs.mkdirSync(CANONICAL_DIR, { recursive: true }); function writeVendorBinary(brPath, rawPath, destPath) { const tmp = destPath + `.tmp.${process.pid}`; try { if (fs.existsSync(brPath)) { fs.writeFileSync(tmp, zlib.brotliDecompressSync(fs.readFileSync(brPath))); } else if (fs.existsSync(rawPath)) { fs.copyFileSync(rawPath, tmp); } else { return false; } if (!IS_WINDOWS) fs.chmodSync(tmp, 0o755); fs.renameSync(tmp, destPath);

High

Ai Review Evidence

Install-time code creates $GROK_HOME/bin and installs/decompresses a platform binary there.

bin/postinstall.jsView on unpkg · L71

199// Write installer config. Path stays ~/.grok/config.toml: that is the Rust // side's config location and is intentionally unchanged in this fork. const configDir = GROK_HOME; const configPath = path.join(configDir, 'config.toml'); let obj = {}; try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { } obj.cli ??= {}; obj.cli.installer = 'npm';

High

Suspicious Lifecycle Evidence

postinstall reads and rewrites $GROK_HOME/config.toml, setting installer and possibly a registry.

bin/postinstall.jsView on unpkg · L199

222if (npmRegistry) { obj.cli.npm_registry = npmRegistry; } fs.writeFileSync(configPath, TOML.stringify(obj), 'utf8');

High

Suspicious Lifecycle Evidence

postinstall reads and rewrites $GROK_HOME/config.toml, setting installer and possibly a registry.

bin/postinstall.jsView on unpkg · L222

Lines 179-242javascript

179 })

180 .sort(byVersionDescending(prefix));

181 for (const old of versionedBinaries.slice(1)) {

182 try { fs.unlinkSync(path.join(CANONICAL_DIR, old)); } catch {}

183 }

184 } catch {}

185}

186

187const platformDir = resolvePlatformPackageDir();

188if (!platformDir) {

189 console.error(`@shuv1337/shuvgrok: platform package @shuv1337/shuvgrok-${key} not installed.`);

190 console.error(' This usually means npm was invoked with --no-optional, or the install failed.');

191 console.error(' Try: npm install -g @shuv1337/shuvgrok');

192 process.exit(0);

193}

194

195installBinary('shuvgrok', platformDir, `shuvgrok${EXE}`);

196cleanupOldVersions('shuvgrok');

197cleanupOldVersions('shuvgrok-pager');

198

199// Write installer config. Path stays ~/.grok/config.toml: that is the Rust

200// side's config location and is intentionally unchanged in this fork.

201const configDir = GROK_HOME;

202const configPath = path.join(configDir, 'config.toml');

203let obj = {};

204try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { }

205obj.cli ??= {};

206obj.cli.installer = 'npm';

High

Suspicious Lifecycle Evidence

postinstall reads and rewrites $GROK_HOME/config.toml, setting installer and possibly a registry.

bin/postinstall.jsView on unpkg · L199

207

208// Persist the npm registry so `shuvgrok update` and the trampoline use the

209// same one.

210const npmRegistry = process.env.GROK_NPM_REGISTRY

211 || (() => {

212 try {

213 const resolved = execSync(

214 'npm config get @shuv1337:registry',

215 { encoding: 'utf8', timeout: 5000 }

216 ).trim();

217 if (resolved && resolved !== 'undefined') return resolved;

218 } catch {}

219 return null;

220 })();

221

222if (npmRegistry) {

223 obj.cli.npm_registry = npmRegistry;

224}

225

226fs.writeFileSync(configPath, TOML.stringify(obj), 'utf8');

High

Suspicious Lifecycle Evidence

postinstall reads and rewrites $GROK_HOME/config.toml, setting installer and possibly a registry.

bin/postinstall.jsView on unpkg · L222

227

228// Shell completions: print setup hints (no silent shell config mutation).

229// Set GROK_INSTALL_COMPLETIONS=1 to auto-generate to ~/.grok/completions.

230const GROK_PATH = path.join(CANONICAL_DIR, `shuvgrok${EXE}`);

231if (process.env.GROK_INSTALL_COMPLETIONS === '1' && !IS_WINDOWS) {

232 try {

233 const { spawnSync } = require('child_process');

234 const completionsDir = path.join(GROK_HOME, 'completions');

235 const bashPath = path.join(completionsDir, 'bash', 'shuvgrok.bash');

236 const zshPath = path.join(completionsDir, 'zsh', '_shuvgrok');

237 fs.mkdirSync(path.dirname(bashPath), { recursive: true });

238 fs.mkdirSync(path.dirname(zshPath), { recursive: true });

239 const bashRes = spawnSync(GROK_PATH, ['completions', 'bash'], { encoding: 'utf8' });

240 if (bashRes.status === 0) fs.writeFileSync(bashPath, bashRes.stdout);

241 const zshRes = spawnSync(GROK_PATH, ['completions', 'zsh'], { encoding: 'utf8' });

242 if (zshRes.status === 0) fs.writeFileSync(zshPath, zshRes.stdout);