Loading npm security reports…

agentic-cortex@7.3.0: Malicious npm security report (Block) | LPM Firewall

registry / agentic-cortex / 7.3.0

agentic-cortex@7.3.0

Persistent self-improving agent memory with tree-of-thoughts reasoning: MCTS/beam search, PRM step verification, self-consistency voting, s1 budget forcing, REPL program-aided reasoning, reflexion self-correction, failure classification, experience replay

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically alters the consuming project’s Git hooks and AI-agent configuration. This enables its local MCP server and instructions without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when installed as a dependency.

Impact

Future Git operations and supported AI coding tools can invoke package-controlled commands and load package-authored instructions.

Mechanism

Automatic consumer-project Git-hook and AI-agent control-surface mutation.

Attack narrative

The package declares a postinstall hook that identifies the consuming project. On installation it creates or modifies project files, installs executable Git hooks, and calls a helper that adds MCP server configurations and agent instruction files. These changes occur automatically rather than through an explicit user setup command, extending package control into multiple AI-agent surfaces and future Git events.

AI rationale

This is an unconsented postinstall mutation of a foreign project’s broad AI-agent control surfaces and Git lifecycle. That concrete automatic persistence behavior meets the publish-block boundary.

Evidence

package.jsonscripts/auto-setup.jsscripts/create-discovery-files.jsknowledge.md.git/hooks/post-merge.git/hooks/post-checkout.git/hooks/post-rewrite.git/hooks/post-commit.mcp.json.cursor/mcp.json

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/auto-setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

scripts/import-community-knowledge.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = scripts/import-community-knowledge.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/import-community-knowledge.jsView on unpkg

750- No hardcoded secrets, API keys, or tokens L751: - No \`eval()\`, no raw SQL concatenation, no \`innerHTML\` with user input L752: - Dependencies are not introducing known vulnerabilities

Low

Eval

Package source references a known benign dynamic code generation pattern.

scripts/import-community-knowledge.jsView on unpkg · L750

examples/offline-demo.jsView file

18L19: const os = require('os'); L20: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/offline-demo.jsView on unpkg · L18

scripts/create-discovery-files.jsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Creates files that various AI coding agents automatically read at session start: L6: * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery) L7: * - .claude/CLAUDE.md (Claude Code) L8: * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true) L9: * - .opencode/agentic-cortex.md (OpenCode) L10: * L11: * Also creates MCP server configuration files: L12: * - .mcp.json (Claude Code) L13: * - .cursor/mcp.json (Cursor) L14: * - opencode.json (OpenCode) L15: * ... L95: * Idempotent — skips if agentic-cortex already configured. Write operation from scripts/auto-setup.js: L89: if (fs.existsSync(templatePath)) { L90: fs.copyFileSync(templatePath, knowledgePath); L91: c

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/create-discovery-files.jsView on unpkg · L5

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. , 'agents.md'); const result = writesection(agentspath, agentsmdcontent); if (result !== 'unchanged') created.push('agents.md'); } catch (err) { console.error('[agentic-cortex] agents.md skipped: ' + err.message); } try { const claudedir = path.join(projectdir, '.claude'); if (!fs.existssync(claudedir)) fs.mkdirsync(claudedir, { recursive: true }); const claudemdcontent = [ '<agentic_cortex>', 'agentic-cortex is installed. persistent, self-improving memory across sessions.', 'mcp server is configured in .mcp.json — ' + mcp_tool_count + ' too

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

src/core/failure-classifier.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = src/core/failure-classifier.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/failure-classifier.jsView on unpkg

scripts/inject-memory.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = scripts/inject-memory.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inject-memory.mjsView on unpkg

src/core/repl-executor.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = src/core/repl-executor.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/repl-executor.jsView on unpkg

src/bench/locomo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = src/bench/locomo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/bench/locomo.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 12-47json

12 "semantic-memory"

13 ],

14 "license": "MIT",

15 "author": "zallauddin",

16 "bin": {

17 "agentic-cortex": "cli.js",

18 "agentic-cortex-mcp": "src/mcp/server.js"

19 },

20 "main": "cli.js",

21 "dependencies": {

22 "better-sqlite3": "^12.11.1"

23 },

24 "optionalDependencies": {

25 "@xenova/transformers": "^2.17.2"

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "scripts": {

31 "test": "node --test tests/*.test.js",

32 "postinstall": "node scripts/auto-setup.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "dashboard": "node cli.js serve"

34 },

35 "files": [

36 "cli.js",

37 "src/",

38 "scripts/",

39 "templates/",

40 "examples/",

41 "README.md",

42 "ARCHITECTURE.md",

43 "QUICKSTART.md",

44 "CONTRIBUTING.md"

45 ]

46}

47

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

scripts/import-community-knowledge.jsView file

Lines 730-770javascript

730 // ═══════════════════════════════════════════════════════════════════

731

732 obs('decision', 'AI-Generated Code Quality Gates: Mandatory Verification Steps', `

733# Code Quality Gates for AI-Generated Code

734

735Before accepting ANY AI-generated code change, apply these gates:

736

737## Gate 1: Syntax & Compilation

738

examples/offline-demo.jsView file

Lines 1-38javascript

1/**

2 * examples/offline-demo.js — Agentic Cortex with ZERO network, ZERO LLM.

3 *

4 * Demonstrates that AC's core memory loop works fully offline:

5 * 1. save observations (SQLite vault, no LLM needed)

6 * 2. search (FTS/keyword — embeddings optional)

7 * 3. build agent context (ranked memory package)

8 * 4. session summarize (deterministic template fallback)

9 *

10 * The provider is forced to 'off' (see src/core/llm-adapter.js); every

scripts/create-discovery-files.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * create-discovery-files.js — Shared module for creating multi-agent discovery files.

4 *

5 * Creates files that various AI coding agents automatically read at session start:

6 * - AGENTS.md (OpenCode, Claude Code — canonical MCP-first discovery)

7 * - .claude/CLAUDE.md (Claude Code)

8 * - .cursor/rules/agentic-cortex.mdc (Cursor, alwaysApply: true)

9 * - .opencode/agentic-cortex.md (OpenCode)

10 *

scripts/cortex-hook.shView file

•path = scripts/cortex-hook.sh kind = build_helper sizeBytes = 7908 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/cortex-hook.shView on unpkg

scripts/seed-memory-repo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = scripts/seed-memory-repo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/seed-memory-repo.jsView on unpkg

src/core/failure-classifier.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = src/core/failure-classifier.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/failure-classifier.jsView on unpkg

scripts/inject-memory.mjsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = scripts/inject-memory.mjs matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inject-memory.mjsView on unpkg

src/core/repl-executor.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = src/core/repl-executor.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/core/repl-executor.jsView on unpkg

src/bench/locomo.jsView file

•matchType = normalized_sha256 matchedPackage = agentic-cortex@6.6.0 matchedPath = src/bench/locomo.js matchedIdentity = npm:YWdlbnRpYy1jb3J0ZXg:6.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/bench/locomo.jsView on unpkg