Loading npm security reports…

@softize/opus@11.1.1: AI-agent control-surface risk | LPM Firewall

registry / @softize/opus / 11.1.1

@softize/opus@11.1.1

End-to-end action protocol for TypeScript. Single package with subpath exports (core + adapters).

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically mutates the consumer repository's AI-agent configuration, instructions, skills, and hooks. It also alters Git hook configuration and local ignore exclusions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall.

Impact

A dependency installation creates persistent controls over agent behavior and repository hooks without an explicit user command.

Mechanism

The postinstall calls setup, which materializes package-controlled files into .agents, .claude, AGENTS.md, CLAUDE.md, and Git hook locations; the installed Claude Stop hook runs a package command.

Policy narrative

Installing the package automatically runs setup in the consumer project. That setup writes package-controlled agent skills and hooks, changes AGENTS.md and CLAUDE.md, registers a Claude Stop command hook, and configures Git hooks. This is an unconsented postinstall mutation of broad AI-agent and repository control surfaces.

AI rationale

The automatic lifecycle path reaches broad persistent AI-agent and Git configuration changes in the consumer repository. This meets the install-control-surface blocking policy.

Evidence

package.jsonbin/lib/postinstall.mjsbin/lib/init.mjsbin/lib/materialize.mjsregistry/hooks/opus-check-on-stop.mjsAGENTS.mdCLAUDE.md.agents/skills.claude/skills

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/lib/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/lib/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/ui/docs/markdown.tsxView file

59) L60: const fn = new Function(...entries.map(([k]) => k), js) L61: const args = entries.map(([, v]) => v)

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/ui/docs/markdown.tsxView on unpkg · L59

bin/lib/db-migrate-runner.mjsView file

44L45: const mod = await import(pathToFileURL(path.resolve(configPath)).href) L46: const config = mod.default ?? mod

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/db-migrate-runner.mjsView on unpkg · L44

bin/lib/init.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L244: } else if (!twConfig) { L245: await fs.writeFile( L246: path.join(projectDir, "tailwind.config.js"), ... L324: if (!(await exists(markerPath)) || (await fs.readFile(markerPath, "utf8")) !== marker) { L325: await fs.writeFile(markerPath, marker); L326: (prev === null ? created : synced).push(MARKER); ... L329: // Remove somente o bloco legado que o próprio setup antigo declarava como gerenciado. L330: const claudePath = path.join(projectDir, "CLAUDE.md"); L331: if (await exists(claudePath)) { ... L334: if (next !== cur) { L335: await fs.writeFile(claudePath, next); L336: synced.push("CLAUDE.md (bloco legado removido)"); Write operation from bin/lib/init.mjs: L244: } else if (!twConfig) { L245: await fs.writeFile( L

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/lib/init.mjsView on unpkg · L1

CHANGELOG.mdView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 101

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

CHANGELOG.mdView on unpkg

bin/lib/db.mjsView file

•matchType = normalized_sha256 matchedPackage = @softize/opus@9.1.1 matchedPath = bin/lib/db.mjs matchedIdentity = npm:QHNvZnRpemUvb3B1cw:9.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/db.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @softize/opus@18.0.1 matchedIdentity = npm:QHNvZnRpemUvb3B1cw:18.0.1 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/db.mjsView on unpkg

bin/lib/gen.mjsView file

•matchType = normalized_sha256 matchedPackage = @softize/opus@9.1.1 matchedPath = bin/lib/gen.mjs matchedIdentity = npm:QHNvZnRpemUvb3B1cw:9.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/gen.mjsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 327-356json

327 "jsonwebtoken": "^9.0.2",

328 "kysely": "^0.27.0",

329 "node-cron": "^3.0.3",

330 "pg": "^8.13.0",

331 "pino": "^9.5.0",

332 "react": "^19.0.0",

333 "react-dom": "^19.0.0",

334 "react-hook-form": "^7.54.0",

335 "tsx": "^4.19.0",

336 "vite": "^6.0.0",

337 "vitest": "^2.1.0",

338 "zod": "^3.24.0"

339 },

340 "repository": {

341 "type": "git",

342 "url": "git+https://github.com/softize-dev/opus.git",

343 "directory": "packages/opus"

344 },

345 "homepage": "https://opus.softize.com.br",

346 "scripts": {

347 "postinstall": "node ./bin/lib/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L347

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L347

348 "typecheck": "tsc --noEmit",

349 "test": "vitest run",

350 "test:watch": "vitest",

351 "test:cov": "vitest run --coverage",

352 "registry:up": "npx -y verdaccio --config ~/.config/verdaccio/config.yaml",

353 "release": "bash ./scripts/release.sh",

354 "release:local": "bash ./scripts/release.sh --local"

355 }

356}

src/ui/docs/markdown.tsxView file

Lines 39-79tsx

39 scope,

40 previewClassName,

41}: {

42 code: string

43 scope: Record<string, unknown>

44 previewClassName?: string

45}): React.ReactElement {

46 const result = React.useMemo

bin/lib/db-migrate-runner.mjsView file

Lines 24-64javascript

24

25function emit(obj) {

26 process.stdout.write(`\n${JSON.stringify(obj)}\n`)

27}

28

bin/lib/init.mjsView file

Lines 1-21javascript

1/** opus setup: aplica o marcador per-app e os artefatos Opus rastreáveis no repo. */

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/lib/init.mjsView on unpkg · L1

3import { promises as fs } from "node:fs";

4import { tmpdir } from "node:os";

5import

CHANGELOG.mdView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 101

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

CHANGELOG.mdView on unpkg

bin/lib/db.mjsView file

•matchType = normalized_sha256 matchedPackage = @softize/opus@9.1.1 matchedPath = bin/lib/db.mjs matchedIdentity = npm:QHNvZnRpemUvb3B1cw:9.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/db.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @softize/opus@18.0.1 matchedIdentity = npm:QHNvZnRpemUvb3B1cw:18.0.1 similarity = 0.450 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/db.mjsView on unpkg

bin/lib/gen.mjsView file

•matchType = normalized_sha256 matchedPackage = @softize/opus@9.1.1 matchedPath = bin/lib/gen.mjs matchedIdentity = npm:QHNvZnRpemUvb3B1cw:9.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/gen.mjsView on unpkg