Loading npm security reports…

@titan-design/active-work@0.18.0: Suspicious npm security report | LPM Firewall

registry / @titan-design/active-work / 0.18.0

@titan-design/active-work@0.18.0

Durable workspace state for engineering work — CLI, MCP, and Claude skill for tracking initiatives across sessions

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm install, postinstall writes this package's Claude Code skill and /aw-prompt command into the user's ~/.claude tree whenever that directory already exists. The write is limited to the package-owned skill folder and one command file.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install or update runs the postinstall script.

Impact

A future Claude Code session can load this package's skill and slash command without a separate setup confirmation. No secret theft or remote execution was identified in that path.

Mechanism

scripts/postinstall.js checks for ~/.claude, removes ~/.claude/skills/active-work, copies the bundled skill there, and copies aw-prompt.md into ~/.claude/commands.

AI rationale

The install hook unconsented copies a first-party Claude skill and one slash command into the user's agent directory, which is guarded extension setup rather than a broad control-surface hijack. Broader MCP registration stays on an explicit setup command, and the inspected entrypoints show no exfiltration or remote payload.

Evidence

package.jsonscripts/postinstall.js~/.claude/skills/active-work~/.claude/commands/aw-prompt.md

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with false-positive risk.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

155Trigger-reachable persistence chain: manifest.bin -> dist/cli.js L155: } L156: const cwd = path.resolve(process.cwd()); L157: if (isInside(cwd, from)) { ... L772: frontmatter: raw.frontmatter, L773: body: raw.body, L774: prefix ... L1497: } L1498: function parseWorktreePorcelain(stdout) { L1499: const out = []; ... L2024: function claudeProjectsRoot() { L2025: const override = process.env.CLAUDE_PROJECTS_ROOT; L2026: if (override && override.length > 0) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L155

155} L156: const cwd = path.resolve(process.cwd()); L157: if (isInside(cwd, from)) { ... L772: frontmatter: raw.frontmatter, L773: body: raw.body, L774: prefix ... L1497: } L1498: function parseWorktreePorcelain(stdout) { L1499: const out = []; ... L2024: function claudeProjectsRoot() { L2025: const override = process.env.CLAUDE_PROJECTS_ROOT; L2026: if (override && override.length > 0) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L155

scripts/postinstall.jsView file

1// Copy the bundled Claude Code skill into ~/.claude/skills/active-work/ and the L2: // /aw-prompt slash command into ~/.claude/commands/ when ~/.claude exists. Skip L3: // silently otherwise. Fail-soft: never abort an npm install if a copy fails. L4: import { existsSync, mkdirSync, cpSync, copyFileSync, rmSync } from 'node:fs'; L5: import { join, dirname } from 'node:path'; ... L12: const commandSource = join(__dirname, '..', 'claude-commands', 'aw-prompt.md'); L13: const claudeDir = join(homedir(), '.claude'); L14: const claudeSkillsDir = join(claudeDir, 'skills', 'active-work'); ... L29: } L30: mkdirSync(claudeSkillsDir, { recursive: true }); L31: cpSync(skillSource, claudeSkillsDir, { recursive: true }); L32: console.log(`active-work: installed Claude Code skill to ${claudeSkillsDi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

dist/chunk-D3CB4EWX.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-D3CB4EWX.jsView on unpkg

dist/aw.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @titan-design/active-work@0.16.0 matchedIdentity = npm:[redacted]:0.16.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/aw.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 27-67json

27 "engines": {

28 "node": ">=22"

29 },

30 "packageManager": "pnpm@10.28.1",

31 "scripts": {

32 "dev": "tsx src/cli.ts",

33 "build": "tsup && pnpm build:dashboard",

34 "build:cli": "tsup",

35 "build:dashboard": "vite build --config src/dashboard/vite.config.ts",

36 "gen:cli-reference": "pnpm build:cli && node scripts/gen-cli-reference.mjs",

37 "mine:session": "node tools/mine-session-signals.mjs",

38 "index:session": "node tools/build-session-index.mjs",

39 "mine:files": "node tools/mine-file-history.mjs",

40 "mine:drain": "node tools/mine-drain.mjs",

41 "mine:drain-eval": "node tools/eval-drain.mjs",

42 "export:aw-data": "node tools/export-aw-data.mjs",

43 "cost:rollup": "node tools/cost-rollup.mjs",

44 "eval:miner": "node tools/eval-miner.mjs",

45 "index:eval": "node tools/eval-session-index.mjs",

46 "check:tools": "for f in tools/*.mjs; do node --check \"$f\" || exit 1; done && node -e \"JSON.parse(require('fs').readFileSync('tools/pricing/models.json','utf8'))\"",

47 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 "preuninstall": "node scripts/preuninstall.js",

49 "test": "vitest run",

50 "test:watch": "vitest",

51 "test:unit": "vitest run --project unit",

52 "test:integration": "vitest run --project integration",

53 "test:coverage": "vitest run --coverage",

54 "typecheck": "tsc --noEmit",

55 "lint": "eslint src __tests__ --no-error-on-unmatched-pattern",

56 "format": "prettier --write \"src/**/*.ts\" \"__tests__/**/*.ts\"",

57 "format:check": "prettier --check \"src/**/*.ts\" \"__tests__/**/*.ts\""

58 },

59 "devDependencies": {

60 "@eslint/js": "^9.39.4",

61 "@types/better-sqlite3": "^7.6.13",

62 "@types/node": "^22.10.5",

63 "@types/proper-lockfile": "^4.1.4",

64 "@types/react": "^19.2.14",

65 "@types/react-dom": "^19.2.3",

66 "@vitejs/plugin-react": "^6.0.1",

67 "@vitest/coverage-v8": "^3.2.7",

dist/cli.jsView file

Lines 135-175javascript

135}

136function yearMonth() {

137 const d = /* @__PURE__ */ new Date();

138 const y = d.

scripts/postinstall.jsView file

Lines 1-21javascript

1// Copy the bundled Claude Code skill into ~/.claude/skills/active-work/ and the

2// /aw-prompt slash command into ~/.claude/commands/ when ~/.claude exists. Skip

3// silently otherwise. Fail-soft: never abort an npm install if a copy fails.

4import { existsSync, mkdirSync, cpSync, copyFileSync, rmSync } from 'node:fs';

5import { join, dirname } from 'node:path';

6import { homedir } from

dist/chunk-D3CB4EWX.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/chunk-D3CB4EWX.jsView on unpkg

dist/aw.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @titan-design/active-work@0.16.0 matchedIdentity = npm:[redacted]:0.16.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/aw.jsView on unpkg