Loading npm security reports…

agentic-cortex@6.1.0: AI-agent control-surface risk | LPM Firewall

registry / agentic-cortex / 6.1.0

agentic-cortex@6.1.0

Persistent self-improving agent memory — install & forget: auto-inject context via git hooks, zero-arg bootstrap, machine-wide global vault, 13 memory types, confidence tracking, XML codebase graphs

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing as a dependency automatically mutates the consuming project’s Git and AI-agent control surfaces. It registers a local MCP server and injects persistent instructions that direct future agents to use it.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall while installing into another project

Impact

Future Claude Code, Cursor, and OpenCode sessions can automatically load package-controlled instructions and execute its MCP server; Git hooks also persist execution after repository events.

Mechanism

unconsented postinstall AI-agent configuration and instruction injection

Policy narrative

The postinstall hook detects the consuming project, installs Git hooks, generates project instructions, and registers agentic-cortex-mcp in Claude Code, Cursor, and OpenCode configuration. These changes occur automatically on dependency installation, create an always-applied Cursor rule, and cause future agent sessions to load package-controlled instructions and capabilities.

Rationale

This is concrete, unconsented postinstall mutation of multiple foreign AI-agent control surfaces, meeting the blocking policy. The absence of a hard-coded exfiltration host does not remove that install-time control-hijack behavior.

Evidence

package.jsonscripts/auto-setup.jsscripts/create-discovery-files.jsscripts/inject-memory.mjs<project>/.git/hooks/post-merge<project>/.git/hooks/post-checkout<project>/.git/hooks/post-rewrite

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/auto-setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/import-community-knowledge.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = scripts/import-community-knowledge.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/import-community-knowledge.jsView on unpkg

750- No hardcoded secrets, API keys, or tokens L751: - No \`eval()\`, no raw SQL concatenation, no \`innerHTML\` with user input L752: - Dependencies are not introducing known vulnerabilities

Low

Eval

Package source references a known benign dynamic code generation pattern.

scripts/import-community-knowledge.jsView on unpkg · L750

preload.jsView file

6L7: const { contextBridge, ipcRenderer } = require('electron'); L8:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

preload.jsView on unpkg · L6

scripts/create-discovery-files.jsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Creates files that various AI coding agents automatically read at session start: L6: * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery) L7: * - .claude/CLAUDE.md (Claude Code) L8: * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true) L9: * - .opencode/agentic-cortex.md (OpenCode / Codebuff) L10: * L11: * Also creates MCP server configuration files: L12: * - .mcp.json (Claude Code) L13: * - .cursor/mcp.json (Cursor) L14: * - opencode.json (OpenCode) L15: * ... L91: * Idempotent — skips if agentic-cortex already configured. Write operation from scripts/auto-setup.js: L89: if (fs.existsSync(templatePath)) { L90: fs.copyFileSync(templatePath, knowledgePa

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/create-discovery-files.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. , 'agents.md'); const result = writesection(agentspath, agentsmdcontent); if (result !== 'unchanged') created.push('agents.md'); } catch (err) { console.error('[agentic-cortex] agents.md skipped: ' + err.message); } try { const claudedir = path.join(projectdir, '.claude'); if (!fs.existssync(claudedir)) fs.mkdirsync(claudedir, { recursive: true }); const claudemdcontent = [ '<agentic_cortex>', 'agentic-cortex is installed. persistent, self-improving memory across sessions.', 'mcp server is configured in .mcp.json — ' + mcp_tool_count + ' too

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = cli.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

electron-main.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = electron-main.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

electron-main.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 10-50json

10 "agent-context",

11 "rag",

12 "semantic-memory"

13 ],

14 "license": "MIT",

15 "author": "zallauddin",

16 "bin": {

17 "agentic-cortex": "cli.js",

18 "agentic-cortex-mcp": "src/mcp/server.js"

19 },

20 "main": "electron-main.js",

21 "dependencies": {

22 "@xenova/transformers": "^2.17.2",

23 "better-sqlite3": "^11.0.0"

24 },

25 "engines": {

26 "node": ">=18"

27 },

28 "scripts": {

29 "test": "node --test tests/*.test.js",

30 "postinstall": "node scripts/auto-setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

31 "tov-editor": "node src/tov/server.js",

32 "electron": "electron .",

33 "electron-dev": "electron . --devtools",

34 "cortex-ui": "electron electron-cortex.js",

35 "cortex-ui-dev": "electron electron-cortex.js --devtools",

36 "dist": "electron-builder"

37 },

38 "files": [

39 "cli.js",

40 "src/",

41 "scripts/",

42 "templates/",

43 "electron-cortex.js",

44 "preload-cortex.js",

45 "electron-main.js",

46 "preload.js",

47 "README.md"

48 ],

49 "devDependencies": {

50 "electron": "^43.2.0",

scripts/import-community-knowledge.jsView file

Lines 730-770javascript

730 // ═══════════════════════════════════════════════════════════════════

731

732 obs('decision', 'AI-Generated Code Quality Gates: Mandatory Verification Steps', `

733# Code Quality Gates for AI-Generated Code

734

735Before accepting ANY AI-generated code change, apply these gates:

736

737## Gate 1: Syntax & Compilation

738

preload.jsView file

Lines 1-26javascript

1/**

2 * preload.js — Secure IPC bridge for the ToV Save Editor Electron app.

3 * Exposes only the APIs the renderer needs via contextBridge.

4 */

5'use strict';

6

7const { contextBridge, ipcRenderer } = require('electron');

scripts/create-discovery-files.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * create-discovery-files.js — Shared module for creating multi-agent discovery files.

4 *

5 * Creates files that various AI coding agents automatically read at session start:

6 * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery)

7 * - .claude/CLAUDE.md (Claude Code)

8 * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true)

9 * - .opencode/agentic-cortex.md (OpenCode / Codebuff)

10 *

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = cli.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

electron-main.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = electron-main.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

electron-main.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.0.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg