Loading npm security reports…

@tui-games/tui: Malicious npm security report (Block) | LPM Firewall

registry / @tui-games/tui / 0.4.9

@tui-games/tui@0.4.9

Play familiar single-player games in a lightweight HTML overlay while your agents work.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

A user-invoked installer writes global AI-agent skills and lifecycle hooks. Those hooks can automatically download and execute a remote overlay binary, while generated agent text discourages inspection.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the package's install command, followed by an agent lifecycle event or overlay launch.

Impact

A remote release host can supply code that runs through installed agent hooks; the installer also alters multiple agent control surfaces.

Mechanism

Global agent-hook installation followed by remote binary download and execution.

Attack narrative

The package’s explicit installer places skills and hooks into global Codex, Claude, Hermes, OpenClaw, and Antigravity locations. The installed hooks invoke the overlay launcher on agent lifecycle events. That launcher fetches a manifest and executable from the release host, trusts a hash supplied by that same host, writes the executable, and starts it detached. The generated skill text also directs agents not to inspect the repository or run other commands, which is reviewer and agent manipulation. A missing Bun runtime additionally triggers a shell pipeline from bun.sh.

AI rationale

This is a concrete remote code execution path coupled to global AI-agent hook installation and instructions designed to suppress inspection. The absence of an npm lifecycle hook does not neutralize the automatic post-install hook path.

Evidence

scripts/install-adapters.shscripts/manage-harness-hooks.tsscripts/overlay.tsscripts/run-with-bun.cjs

Network endpoints2

Source & flagged code

9 flagged · loading source

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tui-games/tui@0.4.8 matchedIdentity = npm:QHR1aS1nYW1lcy90dWk:0.4.8 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

6419// src/auth.ts L6420: import { spawn, spawnSync } from "child_process"; L6421: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6419

scripts/antigravity-hook.tsView file

130/** L131: * The `agy` process behind this hook. Hooks run through `sh -c`, so the harness L132: * is a grandparent rather than the parent; walk up until a command name looks

High

Shell

Package source references shell execution.

scripts/antigravity-hook.tsView on unpkg · L130

scripts/preview-overlay.tsView file

8* bun run preview:overlay -- --scene=restaurant-arena L9: * → http://127.0.0.1:4173/?game=restaurant-arena L10: */ L11: L12: import { spawn } from "node:child_process"; L13: import { existsSync } from "node:fs"; ... L18: const PREVIEW_HTML = join(ROOT, "overlay", "preview.html"); L19: const HOST = process.env.GAMEPIGEON_PREVIEW_HOST ?? "127.0.0.1"; L20: const DEFAULT_PORT = Number(process.env.GAMEPIGEON_PREVIEW_PORT ?? 4173);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/preview-overlay.tsView on unpkg · L8

scripts/run-with-bun.cjsView file

2const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs"); L3: const { spawnSync } = require("node:child_process"); L4: const { homedir } = require("node:os"); ... L9: function candidates() { L10: const name = process.platform === "win32" ? "bun.exe" : "bun"; L11: const paths = []; L12: if (process.env.BUN_INSTALL) paths.push(join(process.env.BUN_INSTALL, "bin", name)); L13: paths.push(join(homedir(), ".bun", "bin", name)); L14: for (const directory of (process.env.PATH || "").split(delimiter)) { ... L23: if (result.status !== 0) return false; L24: const match = String(result.stdout).trim().match(/^(\d+)\.(\d+)/); L25: return Boolean(match && (Number(match[1]) > MIN_BUN[0] || Number(match[1]) === MIN_BUN[0] && Number(match[2]) >= MIN_BUN[1]));

Critical

Download Execute

Source downloads or fetches remote code and executes it.

scripts/run-with-bun.cjsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> scripts/gamepigeon.cjs -> scripts/run-with-bun.cjs L2: const { closeSync, existsSync, mkdirSync, openSync, unlinkSync } = require("node:fs"); L3: const { spawnSync } = require("node:child_process"); L4: const { homedir } = require("node:os"); ... L9: function candidates() { L10: const name = process.platform === "win32" ? "bun.exe" : "bun"; L11: const paths = []; L12: if (process.env.BUN_INSTALL) paths.push(join(process.env.BUN_INSTALL, "bin", name)); L13: paths.push(join(homedir(), ".bun", "bin", name)); L14: for (const directory of (process.env.PATH || "").split(delimiter)) { ... L23: if (result.status !== 0) return false; L24: const match = String(result.stdout).trim().match(/^(\d+)\.(\d+)/); L25: return Boolean(match && (Number(match[1]) > MIN_B

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

scripts/run-with-bun.cjsView on unpkg · L2

scripts/sync-arcade-adapters.test.shView file

•path = scripts/sync-arcade-adapters.test.sh kind = build_helper sizeBytes = 6643 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-arcade-adapters.test.shView on unpkg

overlay/dist/app.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

overlay/dist/app.jsView on unpkg