Loading npm security reports…

agentic-cortex@6.5.1: AI-agent control-surface risk | LPM Firewall

registry / agentic-cortex / 6.5.1

agentic-cortex@6.5.1

Persistent self-improving agent memory with tree-of-thoughts reasoning: MCTS/beam search, PRM step verification, self-consistency voting, s1 budget forcing, REPL program-aided reasoning, reflexion self-correction, 67 MCP tools

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package modifies the consuming project’s AI-agent configuration and instructions without a user command. It also persists CLI execution through Git hooks.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall while installing as a dependency

Impact

Claude Code, Cursor, and OpenCode can load package-authored instructions and launch its MCP server; Git events run its CLI.

Mechanism

foreign AI-agent control-surface mutation and Git-hook persistence

Policy narrative

The postinstall resolves the consuming project and automatically creates or modifies AI-agent instruction and MCP configuration files for multiple unrelated tools. It registers a local MCP server and makes OpenCode load the added AGENTS.md; Cursor receives an always-apply rule. It also writes four Git hooks that invoke the package CLI on repository events. These effects occur without an explicit setup command or consent, constituting broad foreign AI-agent control-surface mutation.

Rationale

Concrete postinstall mutation of foreign, broad AI-agent control surfaces meets the block policy. The absence of observed external exfiltration does not remove the unconsented persistence and control-hijack behavior.

Evidence

package.jsonscripts/auto-setup.jsscripts/create-discovery-files.jsscripts/inject-memory.mjsknowledge.md.mcp.json.cursor/mcp.json.cursor/rules/agentic-cortex.mdc

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/auto-setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/import-community-knowledge.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/import-community-knowledge.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/import-community-knowledge.jsView on unpkg

750- No hardcoded secrets, API keys, or tokens L751: - No \`eval()\`, no raw SQL concatenation, no \`innerHTML\` with user input L752: - Dependencies are not introducing known vulnerabilities

Low

Eval

Package source references a known benign dynamic code generation pattern.

scripts/import-community-knowledge.jsView on unpkg · L750

scripts/demo-nonllm-agent.jsView file

20L21: const api = require('../src/api'); L22: const rules = require('../src/core/rules');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/demo-nonllm-agent.jsView on unpkg · L20

scripts/create-discovery-files.jsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Creates files that various AI coding agents automatically read at session start: L6: * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery) L7: * - .claude/CLAUDE.md (Claude Code) L8: * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true) L9: * - .opencode/agentic-cortex.md (OpenCode / Codebuff) L10: * L11: * Also creates MCP server configuration files: L12: * - .mcp.json (Claude Code) L13: * - .cursor/mcp.json (Cursor) L14: * - opencode.json (OpenCode) L15: * ... L95: * Idempotent — skips if agentic-cortex already configured. Write operation from scripts/auto-setup.js: L89: if (fs.existsSync(templatePath)) { L90: fs.copyFileSync(templatePath, knowledgePa

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/create-discovery-files.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. , 'agents.md'); const result = writesection(agentspath, agentsmdcontent); if (result !== 'unchanged') created.push('agents.md'); } catch (err) { console.error('[agentic-cortex] agents.md skipped: ' + err.message); } try { const claudedir = path.join(projectdir, '.claude'); if (!fs.existssync(claudedir)) fs.mkdirsync(claudedir, { recursive: true }); const claudemdcontent = [ '<agentic_cortex>', 'agentic-cortex is installed. persistent, self-improving memory across sessions.', 'mcp server is configured in .mcp.json — ' + mcp_tool_count + ' too

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg

scripts/auto-setup.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/auto-setup.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/auto-setup.jsView on unpkg

scripts/inject-memory.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/inject-memory.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inject-memory.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 12-43json

12 "semantic-memory"

13 ],

14 "license": "MIT",

15 "author": "zallauddin",

16 "bin": {

17 "agentic-cortex": "cli.js",

18 "agentic-cortex-mcp": "src/mcp/server.js"

19 },

20 "main": "cli.js",

21 "dependencies": {

22 "better-sqlite3": "^12.11.1"

23 },

24 "optionalDependencies": {

25 "@xenova/transformers": "^2.17.2"

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "scripts": {

31 "test": "node --test tests/*.test.js",

32 "postinstall": "node scripts/auto-setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "dashboard": "node cli.js serve"

34 },

35 "files": [

36 "cli.js",

37 "src/",

38 "scripts/",

39 "templates/",

40 "README.md"

41 ]

42}

43

scripts/import-community-knowledge.jsView file

Lines 730-770javascript

730 // ═══════════════════════════════════════════════════════════════════

731

732 obs('decision', 'AI-Generated Code Quality Gates: Mandatory Verification Steps', `

733# Code Quality Gates for AI-Generated Code

734

735Before accepting ANY AI-generated code change, apply these gates:

736

737## Gate 1: Syntax & Compilation

738

scripts/demo-nonllm-agent.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * demo-nonllm-agent.js — Non-LLM Agent Demo

4 *

5 * Demonstrates agentic-cortex v5.0.0's brain orchestration layer executing

6 * a complete bug-fix-cycle using ONLY deterministic state machines, rules,

7 * and workflows — zero LLM calls.

8 *

9 * Architecture:

10 * FSM Engine: debug-workflow (reproducing → diagnosing → fixing → verifying → closed)

11

scripts/create-discovery-files.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * create-discovery-files.js — Shared module for creating multi-agent discovery files.

4 *

5 * Creates files that various AI coding agents automatically read at session start:

6 * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery)

7 * - .claude/CLAUDE.md (Claude Code)

8 * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true)

9 * - .opencode/agentic-cortex.md (OpenCode / Codebuff)

10 *

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

src/sync/git-sync.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = src/sync/git-sync.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sync/git-sync.jsView on unpkg

scripts/auto-setup.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/auto-setup.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/auto-setup.jsView on unpkg

scripts/inject-memory.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.1.0 matchedPath = scripts/inject-memory.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inject-memory.mjsView on unpkg