Loading npm security reports…

@zhushanwen/coding-workflow@2.4.0: AI-agent control-surface risk | LPM Firewall

registry / @zhushanwen/coding-workflow / 2.4.0

@zhushanwen/coding-workflow@2.4.0

CI for AI coding agents: event-sourced ledger, evidence gates, and a deterministic runner that turns briefs into verified units

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies multiple AI-agent instruction and agent directories. This is an unconsented broad AI-agent control-surface change.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

Future agent sessions across supported tools can load package-provided instructions and agents.

Mechanism

Creates package-controlled symlinks in global agent and skill directories.

Policy narrative

The package runs its installer automatically at npm postinstall. That installer places symlinks to package-controlled skills and agents into shared configuration locations for Agents, Claude, and Pi. Those locations affect future AI-agent behavior beyond the package's own command. The installed workflow instructions include mandatory routing and restrictions on alternative agent orchestration. This is a broad foreign AI-agent control-surface mutation without an explicit setup command.

Rationale

Source inspection confirms an automatic postinstall mutation of several foreign AI-agent configuration surfaces. This meets the blocking policy even though the installer avoids overwriting ordinary files and shows no network exfiltration.

Evidence

package.jsonscripts/install-skill.shskills/cw-cli/SKILL.md$HOME/.agents/skills$HOME/.claude/skills$HOME/.agents/agents$HOME/.pi/agent/agents$HOME/.claude/agents

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/install-skill.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/install-skill.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/handlers/run.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/handlers/run.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/handlers/run.jsView on unpkg

48try { L49: moduleNamespace = await import(entry.specifier); L50: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/handlers/run.jsView on unpkg · L48

scripts/install-skill.shView file

•path = scripts/install-skill.sh kind = build_helper sizeBytes = 4133 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skill.shView on unpkg

dist/runner/spawn/lifecycle.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/runner/spawn/lifecycle.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner/spawn/lifecycle.jsView on unpkg

dist/runner/spawn/human.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/runner/spawn/human.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner/spawn/human.jsView on unpkg

dist/runner/spawn/pi.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/runner/spawn/pi.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner/spawn/pi.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 31-69json

31 ],

32 "publishConfig": {

33 "access": "public"

34 },

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/zhushanwen321/coding-workflow.git"

38 },

39 "homepage": "https://github.com/zhushanwen321/coding-workflow#readme",

40 "bugs": {

41 "url": "https://github.com/zhushanwen321/coding-workflow/issues"

42 },

43 "scripts": {

44 "build": "tsc",

45 "check": "tsc --noEmit",

46 "check:tests": "tsc --noEmit -p tsconfig.test.json",

47 "check:all": "npm run check && npm run check:tests",

48 "lint": "eslint src/ tests/",

49 "pretest": "npm run build",

50 "test": "vitest run",

51 "postinstall": "bash scripts/install-skill.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L51

52 "preuninstall": "bash scripts/uninstall-skill.sh"

53 },

54 "dependencies": {

55 "@sinclair/typebox": "^0.34.0",

56 "minimist": "^1.2.8"

57 },

58 "devDependencies": {

59 "@playwright/test": "^1.62.1",

60 "@types/minimist": "^1.2.5",

61 "@types/node": "^22.0.0",

62 "eslint": "^9.0.0",

63 "eslint-plugin-simple-import-sort": "^13.0.0",

64 "typescript": "^5.7.0",

65 "typescript-eslint": "^8.64.0",

66 "vitest": "^3.0.0"

67 }

68}

69

dist/handlers/run.jsView file

Lines 28-68javascript

28 const record = value;

29 return typeof record.name === "string" && typeof record.spawn === "function";

30}

scripts/install-skill.shView file

•path = scripts/install-skill.sh kind = build_helper sizeBytes = 4133 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-skill.shView on unpkg

dist/runner/spawn/lifecycle.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/runner/spawn/lifecycle.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner/spawn/lifecycle.jsView on unpkg

dist/runner/spawn/human.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/runner/spawn/human.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner/spawn/human.jsView on unpkg

dist/runner/spawn/pi.jsView file

•matchType = normalized_sha256 matchedPackage = @zhushanwen/coding-workflow@2.3.0 matchedPath = dist/runner/spawn/pi.js matchedIdentity = npm:[redacted]:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runner/spawn/pi.jsView on unpkg