agent-orchestration-workflow@0.4.0: Suspicious npm security | LPM Firewall

Loading npm security reports…

agent-orchestration-workflow@0.4.0: Suspicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node tools/install-codex-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

20"postinstall": "node tools/install-codex-skill.mjs", "prepublishOnly": "npm run validate:production"

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the Codex skill installer.

package.jsonView on unpkg · L20

tools/install-codex-skill.mjsView file

1#!/usr/bin/env node L2: import { chmodSync, cpSync, existsSync, mkdirSync, renameSync, statSync } from 'node:fs'; L3: import { dirname, join, resolve } from 'node:path'; ... L45: } L46: mkdirSync(backupRoot, { recursive: true }); L47: renameSync(path, join(backupRoot, name)); ... L53: } L54: const codexHome = join(homeDir(), '.codex'); L55: const skillsDir = join(codexHome, 'skills'); L56: const dst = join(skillsDir, SKILL_NAME); L57: mkdirSync(skillsDir, { recursive: true }); L58:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

tools/install-codex-skill.mjsView on unpkg · L1

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: url); const __dirname = dirname(__filename); const pkg_root = resolve(__dirname, '..'); const skill_name = 'agent-orchestration-skill'; const skill_src = join(pkg_root, 'skills', skill_name); const quiet = process.argv.includes('--quiet') || process.env.aow_postinstall_quiet === '1'; const strict = process.argv.includes('--strict') || process.env.aow_postinstall_strict === '1'; function log(message) { if (!quiet) console.log(message); } function warn(message) { if (!quiet) console.warn(message); } function isdirectory(path) { try { return statsync(path).isdirectory(); } catch { return false; } } function homedir() { const home = process.env.home || process.env.userprofile || '

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

tools/install-codex-skill.mjsView on unpkg

54const codexHome = join(homeDir(), '.codex'); const skillsDir = join(codexHome, 'skills'); const dst = join(skillsDir, SKILL_NAME); mkdirSync(skillsDir, { recursive: true }); for (const stale of ['agentic-orchestration-control']) { backupIfPresent(join(skillsDir, stale), skillsDir); } backupIfPresent(dst, skillsDir); cpSync(SKILL_SRC, dst, { recursive: true, force: true });

Medium

Ai Review Evidence

The installer creates and replaces a globally loaded Codex skill under the user home directory.

tools/install-codex-skill.mjsView on unpkg · L54

install.shView file

•path = install.sh kind = build_helper sizeBytes = 12382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/orchestration_lifecycle_validation.pyView file

•path = tests/orchestration_lifecycle_validation.py kind = payload_in_excluded_dir sizeBytes = 13329 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/orchestration_lifecycle_validation.pyView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "agent-orchestration-workflow",

3 "version": "0.4.0",

4 "private": false,

5 "description": "Route-controlled orchestration CLI and four bounded worker roles for Orca projects.",

6 "license": "MIT",

7 "type": "module",

8 "bin": {

9 "aow": "./bin/aow.mjs"

10 },

11 "scripts": {

12 "fix:permissions": "node tools/fix-permissions.mjs",

13 "test": "node tools/fix-permissions.mjs --quiet && PYTHONDONTWRITEBYTECODE=1 python3 tests/workflow_v2_validation.py && PYTHONDONTWRITEBYTECODE=1 python3 tests/orchestration_lifecycle_validation.py && PYTHONDONTWRITEBYTECODE=1 python3 tests/aggressive_validation.py",

14 "test:v2": "PYTHONDONTWRITEBYTECODE=1 python3 tests/workflow_v2_validation.py",

15 "test:npm-cli": "node tools/fix-permissions.mjs --quiet && PYTHONDONTWRITEBYTECODE=1 node tests/aow_03_validation.mjs && PYTHONDONTWRITEBYTECODE=1 node tests/npm_cli_validation.mjs",

16 "pack:dry": "npm pack --dry-run",

17 "doctor": "node bin/aow.mjs doctor",

18 "publish:check": "node tools/fix-permissions.mjs --quiet && node bin/aow.mjs publish-check --pack-dry-run",

19 "validate:production": "node tools/fix-permissions.mjs --quiet && npm test && npm run test:npm-cli && npm run publish:check && npm pack --dry-run",

20 "postinstall": "node tools/install-codex-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

21 "prepublishOnly": "npm run validate:production"

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the Codex skill installer.

package.jsonView on unpkg · L20

22 },

23 "files": [

24 "bin/",

25 "tools/",

26 "skills/agent-orchestration-skill/SKILL.md",

27 "skills/agent-orchestration-skill/bin/aow-control",

28 "skills/agent-orchestration-skill/bin/",

29 "skills/agent-orchestration-skill/config/default-agents.yaml",

30 "skills/agent-orchestration-skill/agents/openai.yaml",

31 "skills/agent-orchestration-skill/references/context-capsule.md",

32 "skills/agent-orchestration-skill/references/context-coverage-gate.md",

33 "skills/agent-orchestration-skill/references/control-plane.md",

34 "skills/agent-orchestration-skill/references/dag-plan-gate.md",

35 "skills/agent-orchestration-skill/references/dispatch-packet.md",

36 "skills/agent-orchestration-skill/references/evaluation-harness.md",

37 "skills/agent-orchestration-skill/references/event-bus.md",

38 "skills/agent-orchestration-skill/references/failure-recovery.md",

39 "skills/agent-orchestration-skill/references/leaf-worker-boundary.md",

40 "skills/agent-orchestration-skill/references/memory-layer.md",

tools/install-codex-skill.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { chmodSync, cpSync, existsSync, mkdirSync, renameSync, statSync } from 'node:fs';

3import { dirname, join, resolve } from 'node:path';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

tools/install-codex-skill.mjsView on unpkg · L1

4import { fileURLToPath } from

install.shView file

•path = install.sh kind = build_helper sizeBytes = 12382 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

tests/orchestration_lifecycle_validation.pyView file

•path = tests/orchestration_lifecycle_validation.py kind = payload_in_excluded_dir sizeBytes = 13329 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/orchestration_lifecycle_validation.pyView on unpkg