registry / AI-agent control-surface risk / @sshaaf/migiq

@sshaaf/migiq

AI-powered application migration orchestrator for modernizing legacy applications to cloud-native platforms

This report shows the evidence for @sshaaf/migiq@0.2.3, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an automatic postinstall mutation of foreign AI-agent control surfaces combined with execution of another CLI installer. Under the isolation policy, that concrete chain requires blocking even though no direct secret theft was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

The package can install behavior-bearing skills and an autonomous agent without an explicit setup command.

Mechanism

Automatic external command execution and AI-agent control-surface writes

Policy narrative

When npm installs this package, its postinstall starts install.js. The installer runs rgctl install --skill, then copies eight package skills into both .claude and .cursor and installs AGENT.md as a migrator agent. These are broad behavior-bearing AI-agent control surfaces in either the consuming project or the user home directory, and the mutation occurs without an explicit user setup command.

AI rationale

Evidence

package.jsoninstall.js.claude/skills/.cursor/skills/.claude/agents/migrator/.cursor/agents/migrator/AGENT.mdmig-rgctl/migiq/mig-plan/mig-prompt-builder/mig-execute/mig-test-gen/mig-containerize/mig-deploy/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The postinstall hook automatically runs the installer.
The installer invokes an external rgctl command during installation.
The installer writes skills into both Claude and Cursor control directories.
The installer copies an autonomous agent into both agent directories.

Evidence against

No direct credential collection or network client code was found in the installer.
The package has no runtime dependencies or self-dependency.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 12.6 KB of source, external domains: github.com

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

76const skillPaths = [ L77: path.join(cwd, '.claude', 'skills', 'rgctl', 'SKILL.md'), L78: path.join(cwd, '.cursor', 'skills', 'rgctl', 'SKILL.md'), ... L96: // Create destination directory L97: fs.mkdirSync(dest, { recursive: true }); L98: ... L108: } else { L109: fs.copyFileSync(srcPath, destPath); L110: } ... L118: const destDir = path.dirname(dest); L119: fs.mkdirSync(destDir, { recursive: true }); L120: fs.copyFileSync(src, dest);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L76

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node const fs = require('fs'); const path = require('path'); const os = require('os'); const { execsync } = require('child_process'); const packagejson = require('./package.json'); const version = packagejson.version; function commandexists(cmd) { try { const check = process.platform === 'win32' ? `where ${cmd}` : `which ${cmd}`; execsync(check, { stdio: 'ignore' }); return true; } catch { return false; } } const rgctl_candidate_paths = [ 'rgctl', path.join(os.homedir(), '.local', 'bin', 'rgctl'), '/opt/homebrew/bin/rgctl', '/usr/local/bin/rgctl', ];

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.jsView on unpkg

mig-plan/evals/aggregate_benchmark.pyView file

•path = mig-plan/evals/aggregate_benchmark.py kind = build_helper sizeBytes = 10547 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mig-plan/evals/aggregate_benchmark.pyView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationinstall.js

HighSemantic Analysis Limitedpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helpermig-plan/evals/aggregate_benchmark.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @sshaaf/migiq@0.2.3.

The versions list below shows the verdict for each recorded version.

Avoid installing @sshaaf/migiq@0.2.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-07 14:32:53.940Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.2.3latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 7, 2026, 2:29 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code