Loading npm security reports…

agentic-cortex: AI-agent control-surface risk | LPM Firewall

registry / agentic-cortex / 7.5.0

agentic-cortex@7.5.0

Persistent self-improving agent memory with tree-of-thoughts reasoning: MCTS/beam search, PRM step verification, self-consistency voting, s1 budget forcing, REPL program-aided reasoning, reflexion self-correction, failure classification, experience replay

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically changes multiple foreign AI-agent configuration and instruction files in the consumer project. These writes register the package's MCP server and direct agents to load its memory context.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when installed into another project.

Impact

Persistent changes to agent tool availability and session instructions across Claude Code, Cursor, and OpenCode.

Mechanism

The installer resolves the consumer directory and unconditionally invokes a helper that merges MCP settings and creates, appends, or updates agent instructions without requesting consent.

Policy narrative

Installing the dependency triggers automatic setup in the consumer project. Setup calls the discovery helper without a consent gate. The helper registers local MCP commands in multiple foreign agent configurations, enables the OpenCode integration, and writes instructions requiring agents to bootstrap package memory. Existing instruction files receive appended sections or version updates. This establishes an unconsented install-time change to a broad AI-agent control surface.

AI rationale

The inspected postinstall chain performs unconsented mutation of foreign agent configurations and instructions, meeting the explicit blocking policy. Package-aligned commands and idempotency guards do not provide consent for these broad writes.

Evidence

package.jsonscripts/auto-setup.jsscripts/create-discovery-files.js.mcp.json.cursor/mcp.jsonopencode.jsonAGENTS.md

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/auto-setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/core/hooks.jsView file

185if (process.env.AGENTIC_CORTEX_HOOKS_JS !== '1') return false; L186: try { return new Function('obs', 'ctx', value)(observation, context); } catch { return false; } L187: default:

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/core/hooks.jsView on unpkg · L185

examples/offline-demo.jsView file

18L19: const os = require('os'); L20: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/offline-demo.jsView on unpkg · L18

scripts/create-discovery-files.jsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Creates files that various AI coding agents automatically read at session start: L6: * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery) L7: * - .claude/CLAUDE.md (Claude Code) L8: * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true) L9: * - .opencode/agentic-cortex.md (OpenCode) L10: * L11: * Also creates MCP server configuration files: L12: * - .mcp.json (Claude Code) L13: * - .cursor/mcp.json (Cursor) L14: * - opencode.json (OpenCode) L15: * ... L95: * Idempotent — skips if agentic-cortex already configured. Write operation from scripts/auto-setup.js: L89: if (fs.existsSync(templatePath)) { L90: fs.copyFileSync(templatePath, knowledgePath); L91: c

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/create-discovery-files.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. , 'agents.md'); const result = writesection(agentspath, agentsmdcontent); if (result !== 'unchanged') created.push('agents.md'); } catch (err) { console.error('[agentic-cortex] agents.md skipped: ' + err.message); } try { const claudedir = path.join(projectdir, '.claude'); if (!fs.existssync(claudedir)) fs.mkdirsync(claudedir, { recursive: true }); const claudemdcontent = [ '<agentic_cortex>', 'agentic-cortex is installed. persistent, self-improving memory across sessions.', 'mcp server is configured in .mcp.json — ' + mcp_tool_count + ' too

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/memorybench-head-to-head.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/memorybench-head-to-head.js#virtual:normalized:round1View on unpkg

scripts/import-community-knowledge.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = scripts/import-community-knowledge.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/import-community-knowledge.jsView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

src/core/failure-classifier.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = src/core/failure-classifier.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/failure-classifier.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg

scripts/auto-setup.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = scripts/auto-setup.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/auto-setup.jsView on unpkg

scripts/inject-memory.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = scripts/inject-memory.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inject-memory.mjsView on unpkg

src/core/manifest.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.4.0 matchedPath = src/core/manifest.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/manifest.jsView on unpkg

src/core/repl-executor.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = src/core/repl-executor.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/repl-executor.jsView on unpkg

src/core/worker.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = src/core/worker.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/worker.jsView on unpkg

examples/mcp-demo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.4.0 matchedPath = examples/mcp-demo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

examples/mcp-demo.jsView on unpkg

scripts/generate-graph.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = scripts/generate-graph.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/generate-graph.mjsView on unpkg

src/bench/locomo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@7.2.0 matchedPath = src/bench/locomo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:7.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/bench/locomo.jsView on unpkg