AI Security Review
scanned 3h ago · by lpm-firewall-aiLPM blocks this version under the AI-agent control-surface policy. Confirmed install-time mutation of a foreign AI/OAuth dependency page. The changed page is used during provider sign-in flows and is altered without explicit user consent.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install postinstall
Impact
Can alter the trust/branding context of AI-provider sign-in flows and persists inside installed dependency files.
Mechanism
unconsented dependency OAuth callback page rewrite
Policy narrative
On npm install, the postinstall script locates the @earendil-works/pi-ai OAuth module and rewrites its callback page, replacing logo, title, favicon, and injecting Brigade-branded assets. This is a foreign AI/OAuth control-surface mutation performed automatically at install time, even though no exfiltration or remote payload fetch was found.
Rationale
The source confirms an unconsented postinstall write into a dependency-owned AI/OAuth sign-in callback surface, which matches the block policy even though the observed payload is cosmetic branding rather than credential theft. Other risky scanner hits were package-aligned CLI/agent features or defensive scanning code. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsonscripts/brand-oauth-page.mjsbrigade.mjsdist/entry.jsdist/agents/extensions/install.jsdist/agents/extensions/install-scan.jsdist/security/injection-patterns.jsscripts/assets/brigade-logo.webpscripts/assets/brigade-favicon.iconode_modules/@earendil-works/pi-ai/**/utils/oauth/oauth-page.js
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for policy block
- package.json defines postinstall: node scripts/brand-oauth-page.mjs
- scripts/brand-oauth-page.mjs resolves @earendil-works/pi-ai/oauth then writes utils/oauth/oauth-page.js inside that dependency
- Postinstall changes OAuth callback branding for Claude Pro/Max, ChatGPT, and GitHub Copilot sign-in without user action
- The hook inlines shipped logo/favicon assets into the foreign SDK page and replaces title/favicon/logo
Evidence against
- No credential harvesting or exfiltration found in the postinstall script
- No outbound network calls in scripts/brand-oauth-page.mjs
- dist/entry.js and brigade.mjs are CLI dispatch shims, not import-time exfiltration
- dist/agents/extensions/install.js installs user-requested extensions and surfaces scan findings rather than auto-running them
- dist/security/injection-patterns.js is a defensive scanner; unicode range is in a regex, not hidden control flow
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Oversized source lightweight scan
dist/ui/brand-frames-cli.js2.36 MB file, sampled 256 KB
Minified
Source & flagged code
26 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/brand-oauth-page.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/ui/onboarding.jsView file
14*/
L15: import { spawn } from "node:child_process";
L16: import { getModels } from "@earendil-works/pi-ai";
High
Child Process
Package source references child process execution.
dist/ui/onboarding.jsView on unpkg · L14dist/core/daemon/systemd.jsView file
21.join("\n");
L22: const execArgs = [ctx.nodePath, ctx.brigadeBin, "gateway", "run"]
L23: .map((s) => (s.includes(" ") ? `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : s))
High
8*/
L9: import { spawn } from "node:child_process";
L10: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
...
L14: function unitPath() {
L15: return path.join(os.homedir(), ".config", "systemd", "user", SERVICE_UNIT_NAME);
L16: }
...
L36: "RestartSec=2",
L37: `StandardOutput=append:${ctx.stdoutPath}`,
L38: `StandardError=append:${ctx.stderrPath}`,
...
L74: if (r.code !== 0) {
L75: return { ok: false, message: `systemctl enable failed: ${r.stderr.trim()}`, unitPath: file };
L76: }
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/core/daemon/systemd.jsView on unpkg · L8dist/agents/org/pride-image.jsView file
90// consistent with how Brigade lazy-loads other heavy modules.)
L91: const importer = new Function("s", "return import(s)");
L92: const mod = (await importer("playwright-core"));
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/agents/org/pride-image.jsView on unpkg · L90brigade.mjsView file
54try {
L55: const mod = await import("node:module");
L56: if (typeof mod.enableCompileCache === "function" && !process.env.NODE_DISABLE_COMPILE_CACHE) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
brigade.mjsView on unpkg · L54dist/agents/tool-loop-detector.jsView file
1/**
L2: * Tool-loop detector — catches the model when it's stuck calling the same
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/agents/tool-loop-detector.jsView on unpkg · L1scripts/convex-dev.mjsView file
16L17: import { spawn } from "node:child_process";
L18: import { mkdirSync, existsSync, writeFileSync, readFileSync, unlinkSync } from "node:fs";
L19: import { randomBytes } from "node:crypto";
L20: import { createServer } from "node:http";
L21: import { readFile, stat } from "node:fs/promises";
...
L30: // or `npm run convex:dev` from a checkout (→ <root>/.convex-data, the default).
L31: const DATA_DIR = process.env.BRIGADE_CONVEX_DATA_DIR?.trim() || join(ROOT, ".convex-data");
L32: const DASHBOARD_DIR = join(BIN_DIR, "dashboard");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/convex-dev.mjsView on unpkg · L16dist/infra/net/fetch-guard.jsView file
4* Why this exists: Brigade runs LLM-controllable URLs through `fetch`.
L5: * Without a guard, a model can be tricked into hitting `http://169.254.169.254/`
L6: * (cloud metadata) or `http://localhost:1234/` (developer service) and
...
L20: import { isIP, isIPv4, isIPv6 } from "node:net";
L21: import { promises as dnsPromises } from "node:dns";
L22: import { DEFAULT_TIMEOUT_SECONDS } from "../../agents/tools/web-shared.js";
...
L28: * Cloud-metadata + forbidden-literal hosts that stay blocked EVEN WHEN
L29: * `allowPrivateNetwork` is set — these are never a legitimate LAN target and are
L30: * the highest-value SSRF destinations.
...
L364: headers: currentHeaders,
L365: body: currentBody ?? undefined,
L366: redirect: "manual",
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/infra/net/fetch-guard.jsView on unpkg · L4dist/security/injection-patterns.jsView file
58contains invisible/control Unicode U+200B (zero width space)
const INVISIBLE_CODEPOINTS = /[<U+200B>-<U+200D><U+2060>-<U+FEFF><U+202A>-<U+202E><U+2066>-<U+2069>]/;
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/security/injection-patterns.jsView on unpkg · L58scripts/convex-push.mjsView file
75console.log(`▌ Pushing convex/ functions → ${target}`);
L76: const res = spawnSync("npx", ["convex", "deploy", "--yes"], {
L77: cwd: ROOT,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/convex-push.mjsView on unpkg · L75skills/video-frames/scripts/frame.shView file
•path = skills/video-frames/scripts/frame.sh
kind = build_helper
sizeBytes = 1347
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
skills/video-frames/scripts/frame.shView on unpkgscripts/assets/brigade-favicon.icoView file
•path = scripts/assets/brigade-favicon.ico
kind = high_entropy_blob
sizeBytes = 19371
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
scripts/assets/brigade-favicon.icoView on unpkgdist/ui/brand-frames-cli.jsView file
•path = dist/ui/brand-frames-cli.js
kind = oversized_source_file
sizeBytes = 2475115
magicHex = [redacted]
High
Oversized Source File
Package contains source files above the static scanner size ceiling.
dist/ui/brand-frames-cli.jsView on unpkg•path = dist/ui/brand-frames-cli.js
kind = oversized_cli_entrypoint
sizeBytes = 2475115
magicHex = [redacted]
Medium
Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/ui/brand-frames-cli.jsView on unpkgdist/agents/extensions/install-scan.jsView file
•matchType = normalized_sha256
matchedPackage = @spinabot/brigade@1.25.0
matchedPath = dist/agents/extensions/install-scan.js
matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.25.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/agents/extensions/install-scan.jsView on unpkgdist/agents/extensions/install.jsView file
•matchType = normalized_sha256
matchedPackage = @spinabot/brigade@1.25.0
matchedPath = dist/agents/extensions/install.js
matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.25.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/agents/extensions/install.jsView on unpkgdist/core/daemon/launchd.jsView file
•matchType = normalized_sha256
matchedPackage = @spinabot/brigade@1.25.0
matchedPath = dist/core/daemon/launchd.js
matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.25.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/daemon/launchd.jsView on unpkgdist/core/daemon/schtasks.jsView file
•matchType = normalized_sha256
matchedPackage = @spinabot/brigade@1.25.0
matchedPath = dist/core/daemon/schtasks.js
matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.25.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/daemon/schtasks.jsView on unpkgdist/core/tunnel/providers/bore.jsView file
•matchType = normalized_sha256
matchedPackage = @spinabot/brigade@1.25.0
matchedPath = dist/core/tunnel/providers/bore.js
matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.25.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/core/tunnel/providers/bore.jsView on unpkgdist/agents/channels/bluebubbles/account-config.d.tsView file
28patternName = generic_password
severity = medium
line = 28
matchedText = * ch...}" }
Medium
Secret Pattern
Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts
dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L2834patternName = generic_password
severity = medium
line = 34
matchedText = * ..." },
Medium
Secret Pattern
Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts
dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L3435patternName = generic_password
severity = medium
line = 35
matchedText = * ..." },
Medium
Secret Pattern
Hardcoded password in dist/agents/channels/bluebubbles/account-config.d.ts
dist/agents/channels/bluebubbles/account-config.d.tsView on unpkg · L35dist/agents/channels/bluebubbles/account-config.jsView file
28patternName = generic_password
severity = medium
line = 28
matchedText = * ch...}" }
Medium
Secret Pattern
Hardcoded password in dist/agents/channels/bluebubbles/account-config.js
dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L2834patternName = generic_password
severity = medium
line = 34
matchedText = * ..." },
Medium
Secret Pattern
Hardcoded password in dist/agents/channels/bluebubbles/account-config.js
dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L3435patternName = generic_password
severity = medium
line = 35
matchedText = * ..." },
Medium
Secret Pattern
Hardcoded password in dist/agents/channels/bluebubbles/account-config.js
dist/agents/channels/bluebubbles/account-config.jsView on unpkg · L35Findings
1 Critical13 High13 Medium7 Low
CriticalTrojan Source Unicodedist/security/injection-patterns.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/ui/onboarding.js
HighShelldist/core/daemon/systemd.js
HighSame File Env Network Executionscripts/convex-dev.mjs
HighCloud Metadata Accessdist/infra/net/fetch-guard.js
HighRuntime Package Installscripts/convex-push.mjs
HighShips High Entropy Blobscripts/assets/brigade-favicon.ico
HighOversized Source Filedist/ui/brand-frames-cli.js
HighKnown Malware Source Similaritydist/agents/extensions/install-scan.js
HighKnown Malware Source Similaritydist/agents/extensions/install.js
HighKnown Malware Source Similaritydist/core/daemon/launchd.js
HighKnown Malware Source Similaritydist/core/daemon/schtasks.js
HighKnown Malware Source Similaritydist/core/tunnel/providers/bore.js
MediumDynamic Requirebrigade.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/core/daemon/systemd.js
MediumShips Build Helperskills/video-frames/scripts/frame.sh
MediumOversized Cli Entrypointdist/ui/brand-frames-cli.js
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/agents/channels/bluebubbles/account-config.d.ts
MediumSecret Patterndist/agents/channels/bluebubbles/account-config.d.ts
MediumSecret Patterndist/agents/channels/bluebubbles/account-config.d.ts
MediumSecret Patterndist/agents/channels/bluebubbles/account-config.js
MediumSecret Patterndist/agents/channels/bluebubbles/account-config.js
MediumSecret Patterndist/agents/channels/bluebubbles/account-config.js
LowScripts Present
LowEvaldist/agents/org/pride-image.js
LowWeak Cryptodist/agents/tool-loop-detector.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings