Loading npm security reports…

@titan-design/active-work@0.16.0: Suspicious npm security report | LPM Firewall

registry / @titan-design/active-work / 0.16.0

@titan-design/active-work@0.16.0

Durable workspace state for engineering work — CLI, MCP, and Claude skill for tracking initiatives across sessions

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm install, postinstall writes this package's own Claude Code skill and one slash command into the user Claude directory when that directory already exists. The change is product-scoped and does not fetch or execute a remote payload.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Automatic npm postinstall when ~/.claude already exists.

Impact

A Claude Code user gets this package's skill and /aw-prompt command installed without a separate setup command. The skill directs the agent to use the active-work CLI for workspace state.

Mechanism

The script removes ~/.claude/skills/active-work if present, copies the bundled skill tree there, and copies aw-prompt.md into ~/.claude/commands.

AI rationale

Install-time mutation is limited to this package's own Claude skill directory and one slash command, which is first-party agent extension setup rather than a broad or foreign control-surface hijack. No exfiltration, remote execution, or self-install chain was found, so the lifecycle write warrants a warning instead of a publish block.

Evidence

package.jsonscripts/postinstall.js~/.claude/skills/active-work~/.claude/commands/aw-prompt.md

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with false-positive risk.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

155Trigger-reachable persistence chain: manifest.bin -> dist/cli.js L155: } L156: const cwd = path.resolve(process.cwd()); L157: if (isInside(cwd, from)) { ... L772: frontmatter: raw.frontmatter, L773: body: raw.body, L774: prefix ... L1497: } L1498: function parseWorktreePorcelain(stdout) { L1499: const out = []; ... L2024: function claudeProjectsRoot() { L2025: const override = process.env.CLAUDE_PROJECTS_ROOT; L2026: if (override && override.length > 0) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L155

•matchType = previous_version_dangerous_delta matchedPackage = @titan-design/active-work@0.13.0 matchedIdentity = npm:[redacted]:0.13.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

155} L156: const cwd = path.resolve(process.cwd()); L157: if (isInside(cwd, from)) { ... L772: frontmatter: raw.frontmatter, L773: body: raw.body, L774: prefix ... L1497: } L1498: function parseWorktreePorcelain(stdout) { L1499: const out = []; ... L2024: function claudeProjectsRoot() { L2025: const override = process.env.CLAUDE_PROJECTS_ROOT; L2026: if (override && override.length > 0) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L155

scripts/postinstall.jsView file

1// Copy the bundled Claude Code skill into ~/.claude/skills/active-work/ and the L2: // /aw-prompt slash command into ~/.claude/commands/ when ~/.claude exists. Skip L3: // silently otherwise. Fail-soft: never abort an npm install if a copy fails. L4: import { existsSync, mkdirSync, cpSync, copyFileSync, rmSync } from 'node:fs'; L5: import { join, dirname } from 'node:path'; ... L12: const commandSource = join(__dirname, '..', 'claude-commands', 'aw-prompt.md'); L13: const claudeDir = join(homedir(), '.claude'); L14: const claudeSkillsDir = join(claudeDir, 'skills', 'active-work'); ... L29: } L30: mkdirSync(claudeSkillsDir, { recursive: true }); L31: cpSync(skillSource, claudeSkillsDir, { recursive: true }); L32: console.log(`active-work: installed Claude Code skill to ${claudeSkillsDi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

dist/chunk-AOP33ALP.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-AOP33ALP.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 27-67json

27 "engines": {

28 "node": ">=22"

29 },

30 "packageManager": "pnpm@10.28.1",

31 "scripts": {

32 "dev": "tsx src/cli.ts",

33 "build": "tsup && pnpm build:dashboard",

34 "build:cli": "tsup",

35 "build:dashboard": "vite build --config src/dashboard/vite.config.ts",

36 "gen:cli-reference": "pnpm build:cli && node scripts/gen-cli-reference.mjs",

37 "mine:session": "node tools/mine-session-signals.mjs",

38 "index:session": "node tools/build-session-index.mjs",

39 "mine:files": "node tools/mine-file-history.mjs",

40 "mine:drain": "node tools/mine-drain.mjs",

41 "mine:drain-eval": "node tools/eval-drain.mjs",

42 "export:aw-data": "node tools/export-aw-data.mjs",

43 "cost:rollup": "node tools/cost-rollup.mjs",

44 "eval:miner": "node tools/eval-miner.mjs",

45 "index:eval": "node tools/eval-session-index.mjs",

46 "check:tools": "for f in tools/*.mjs; do node --check \"$f\" || exit 1; done && node -e \"JSON.parse(require('fs').readFileSync('tools/pricing/models.json','utf8'))\"",

47 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "preuninstall": "node scripts/preuninstall.js",

49 "test": "vitest run",

50 "test:watch": "vitest",

51 "test:unit": "vitest run --project unit",

52 "test:integration": "vitest run --project integration",

53 "test:coverage": "vitest run --coverage",

54 "typecheck": "tsc --noEmit",

55 "lint": "eslint src __tests__ --no-error-on-unmatched-pattern",

56 "format": "prettier --write \"src/**/*.ts\" \"__tests__/**/*.ts\"",

57 "format:check": "prettier --check \"src/**/*.ts\" \"__tests__/**/*.ts\""

58 },

59 "devDependencies": {

60 "@eslint/js": "^9.39.4",

61 "@types/better-sqlite3": "^7.6.13",

62 "@types/node": "^22.10.5",

63 "@types/proper-lockfile": "^4.1.4",

64 "@types/react": "^19.2.14",

65 "@types/react-dom": "^19.2.3",

66 "@vitejs/plugin-react": "^6.0.1",

67 "@vitest/coverage-v8": "^3.2.7",

dist/cli.jsView file

Lines 135-175javascript

135}

136function yearMonth() {

137 const d = /* @__PURE__ */ new Date();

138 const y = d.

scripts/postinstall.jsView file

Lines 1-21javascript

1// Copy the bundled Claude Code skill into ~/.claude/skills/active-work/ and the

2// /aw-prompt slash command into ~/.claude/commands/ when ~/.claude exists. Skip

3// silently otherwise. Fail-soft: never abort an npm install if a copy fails.

4import { existsSync, mkdirSync, cpSync, copyFileSync, rmSync } from 'node:fs';

5import { join, dirname } from 'node:path';

6import { homedir } from

dist/chunk-AOP33ALP.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-AOP33ALP.jsView on unpkg