registry / AI-agent control-surface risk / ai-usage-meter
ai-usage-meter
Show Claude, ChatGPT/Codex, and Gemini activity and usage on an AI Meter display.
This report shows the evidence for ai-usage-meter@0.1.5. 3 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe global postinstall performs broad assistant configuration changes and installs persistent launch agents without a separate setup action. This supports blocking as install-time AI-agent control-surface hijacking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm executes the postinstall hook during a global install.
Impact
The package gains automatic execution in supported assistant sessions and persistent background execution without a separate setup command.
Mechanism
The hook calls setup for all supported assistants, writes their settings files, and registers launch agents that start at login.
Policy narrative
On global installation, postinstall invokes setup for all supported assistants. Setup registers package hooks and status-line commands in their settings, then installs launch agents configured to run at login, including a keep-alive monitor. This is unconsented installation-time mutation of multiple AI-agent control surfaces.
AI rationale
The global postinstall performs broad assistant configuration changes and installs persistent launch agents without a separate setup action. This supports blocking as install-time AI-agent control-surface hijacking.
Evidence
package.jsonsetup/postinstall.mjssetup/setup.mjs
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm postinstall hook runs automatically, but runs setup only for global installs.
- The global-install branch configures all supported assistants without a separate setup command.
- Setup writes assistant settings that register package hooks and a status-line command, and installs background launch agents.
- The launch agents run at login; one is configured to stay alive.
Evidence against
- For non-global installs, postinstall exits and tells the user to run setup explicitly.
- The source shows device-monitoring and usage-sync setup, but no credential exfiltration or unrelated account actions.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node setup/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg39"postinstall": "node setup/postinstall.mjs"
},
"engines": {
"node": ">=20"
},
"os": ["darwin"]
}
High
Suspicious Lifecycle Evidence
The npm postinstall hook runs automatically, but runs setup only for global installs.
package.jsonView on unpkg · L39•scripts.postinstall = node setup/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsetup/postinstall.mjsView file
Findings
1 Critical3 High4 Medium4 Low
CriticalAi Agent Control Hijacksetup/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencesetup/postinstall.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Native Binaryvendor/picotool/darwin-arm64/libusb-1.0.0.dylib
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ai-usage-meter@0.1.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing ai-usage-meter@0.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
4 known versions0.1.5latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 24, 2026, 11:10 AM0.1.2MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 18, 2026, 4:27 AM0.1.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 17, 2026, 1:15 PM0.0.1Clean—AllowPublishedSep 11, 2026, 12:06 PM