@shuv1337/shuvgrok@1.0.6: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@shuv1337/shuvgrok@1.0.6: AI-agent control-surface risk | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

25"scripts": { "postinstall": "node bin/postinstall.js" }

High

Suspicious Lifecycle Evidence

Installation automatically runs a Node postinstall program.

package.jsonView on unpkg · L25

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.6-97098a6 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.6-97098a6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

71fs.mkdirSync(CANONICAL_DIR, { recursive: true });

High

Suspicious Lifecycle Evidence

The postinstall program creates a shared ~/.grok bin directory and installs an executable there.

bin/postinstall.jsView on unpkg · L71

208// Persist the npm registry so `shuvgrok update` and the trampoline use the // same one. const npmRegistry = process.env.GROK_NPM_REGISTRY || (() => { try { const resolved = execSync( 'npm config get @shuv1337:registry', { encoding: 'utf8', timeout: 5000 } ).trim(); if (resolved && resolved !== 'undefined') return resolved; } catch {} return null; })(); if (npmRegistry) { obj.cli.npm_registry = npmRegistry; } fs.writeFileSync(configPath, TOML.stringify(obj), 'utf8');

High

Ai Review Evidence

It rewrites ~/.grok/config.toml and records a registry value from the environment or npm configuration.

bin/postinstall.jsView on unpkg · L208

Lines 179-228javascript

179 })

180 .sort(byVersionDescending(prefix));

181 for (const old of versionedBinaries.slice(1)) {

182 try { fs.unlinkSync(path.join(CANONICAL_DIR, old)); } catch {}

183 }

184 } catch {}

185}

186

187const platformDir = resolvePlatformPackageDir();

188if (!platformDir) {

189 console.error(`@shuv1337/shuvgrok: platform package @shuv1337/shuvgrok-${key} not installed.`);

190 console.error(' This usually means npm was invoked with --no-optional, or the install failed.');

191 console.error(' Try: npm install -g @shuv1337/shuvgrok');

192 process.exit(0);

193}

194

195installBinary('shuvgrok', platformDir, `shuvgrok${EXE}`);

196cleanupOldVersions('shuvgrok');

197cleanupOldVersions('shuvgrok-pager');

198

199// Write installer config. Path stays ~/.grok/config.toml: that is the Rust

200// side's config location and is intentionally unchanged in this fork.

201const configDir = GROK_HOME;

202const configPath = path.join(configDir, 'config.toml');

High

Ai Review Evidence

The shared config location is explicitly described as compatible with the upstream Grok installation.

bin/postinstall.jsView on unpkg · L199

203let obj = {};

204try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { }

205obj.cli ??= {};

206obj.cli.installer = 'npm';

207

208// Persist the npm registry so `shuvgrok update` and the trampoline use the

209// same one.

210const npmRegistry = process.env.GROK_NPM_REGISTRY

211 || (() => {

212 try {

213 const resolved = execSync(

214 'npm config get @shuv1337:registry',

215 { encoding: 'utf8', timeout: 5000 }

216 ).trim();

217 if (resolved && resolved !== 'undefined') return resolved;

218 } catch {}

219 return null;

High

Ai Review Evidence

It rewrites ~/.grok/config.toml and records a registry value from the environment or npm configuration.

bin/postinstall.jsView on unpkg · L208

220 })();

221

222if (npmRegistry) {

223 obj.cli.npm_registry = npmRegistry;

224}

225

226fs.writeFileSync(configPath, TOML.stringify(obj), 'utf8');

227

228// Shell completions: print setup hints (no silent shell config mutation).