registry / amicus / 2.2.0

amicus@2.2.0

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm postinstall mutates Claude Code and Claude Desktop/Cowork control surfaces. It installs auto-triggered skills and registers a user-scope MCP server that later executes `amicus@latest`.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install executes the postinstall lifecycle hook unless `AMICUS_SKIP_POSTINSTALL=1` is preset.

Impact

Future Claude sessions can load package-supplied instructions and invoke a mutable remote MCP payload.

Mechanism

unconsented AI-agent skill deployment and MCP configuration injection

Policy narrative

On installation, the package's postinstall runs automatically, copies its skill instructions into the user's Claude skill directory, and registers an MCP server in Claude Code and Claude Desktop/Cowork configuration. The registration invokes `npx -y amicus@latest mcp`, so later agent use resolves and executes the moving latest package rather than the reviewed installed version. This is an unconsented install-time mutation of broad external AI-agent control surfaces.

Rationale

Direct source inspection confirms an automatic postinstall writes foreign Claude configuration and instruction files, then injects a mutable `@latest` MCP launcher. This meets the firewall block boundary for unconsented postinstall AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.jsskills/sidecar/SKILL.mdskills/second-opinion/SKILL.mdsrc/utils/mcp-self-identity.js~/.claude/skills/sidecar/SKILL.md~/.claude/skills/second-opinion/SKILL.md~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `node scripts/postinstall.js` automatically.
`scripts/postinstall.js` copies package skills into `~/.claude/skills/` without user action.
Postinstall registers an `amicus` MCP server in `~/.claude.json` and Claude Desktop config.
The injected MCP command is `npx -y amicus@latest mcp`, a mutable latest-version launcher.
Postinstall overwrites any non-Amicus MCP entry named `amicus`.

Evidence against

No default postinstall network request is confirmed; Electron network prewarm requires `AMICUS_PREFETCH_ELECTRON=1`.
Observed API-key handling supports the package's stated multi-model runtime, not install-time exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 146 file(s), 908 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.deepseek.com, api.openai.com, console.anthropic.com, generativelanguage.googleapis.com, nodejs.org, openrouter.ai, platform.deepseek.com, platform.openai.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 36-76json

36 },

37 "files": [

38 "bin/",

39 "src/",

40 "electron/",

41 "skills/",

42 "commands/",

43 ".claude-plugin/",

44 "CHANGELOG.md",

45 "scripts/postinstall.js",

46 "scripts/setup-hooks.js"

47 ],

48 "scripts": {

49 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

50 "test": "jest",

51 "test:integration": "jest --testPathIgnorePatterns='\\.worktrees/' --testMatch='**/tests/**/*.integration.test.js'",

52 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='\\.worktrees/' && node scripts/mark-test-passed.js",

53 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

54 "posttest": "node scripts/mark-test-passed.js",

55 "lint": "eslint src/",

56 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "test:thinking": "node scripts/benchmark-thinking.js",

58 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

59 "refresh-models": "node bin/amicus.js models --refresh",

60 "models:info": "node bin/amicus.js models",

61 "models:check": "node bin/amicus.js models --check",

62 "generate-icon": "node scripts/generate-icon.js",

63 "generate-docs": "node scripts/generate-docs.js",

64 "generate-docs:check": "node scripts/generate-docs.js --check",

65 "validate-docs": "node scripts/validate-docs.js --full",

66 "setup-hooks": "node scripts/setup-hooks.js",

67 "check:secrets": "node scripts/check-secrets.js --all",

68 "check:sizes": "node scripts/check-file-sizes.js --all",

69 "check:tarball": "node scripts/check-tarball-lifecycle.js"

70 },

71 "dependencies": {

72 "@modelcontextprotocol/sdk": "^1.27.0",

73 "@opencode-ai/sdk": "^1.1.36",

74 "dotenv": "^17.2.3",

75 "opencode-ai": "^1.2.20",

76 "tiktoken": "^1.0.0",

bin/amicus.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

10// Load API keys from all sources: process.env > amicus .env > auth.json

11const { loadCredentials } = require('../src/utils/env-loader');

12loadCredentials();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

14const { parseArgs, getUsage, getCommandNames } = require('../src/cli');

15const { handleSetup, handleAbort, handleUpdate, handleMcp, handleKey } = require('../src/cli-handlers');

16const { handleStart, handleFanout, handleRead } = require('../src/cli-handlers-run');

17const { handleResume, handleContinue } = require('../src/cli-handlers-resume-continue');

18const { isOneShotCommand, armExitWatchdog } = require('../src/utils/lifecycle');

19const { suggestCommand } = require('../src/utils/input-validators');

20const { logger } = require('../src/utils/logger');

22const VERSION = require('../package.json').version;

24async function main() {

25 const args = parseArgs(process.argv.slice(2));

26 const command = args._[0];

28 // Install crash handler for MCP-spawned processes (have --task-id)

29 if (args['task-id'] && (command === 'start' || command === 'continue')) {

30 const { installCrashHandler } = require('../src/sidecar/crash-handler');

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3/**

4 * Post-install script for amicus

5 *

6 * 1. Copies SKILL.md to ~/.claude/skills/sidecar/

7 * 2. Registers MCP server in Claude Code (~/.claude.json)

8 * 3. Registers MCP server in Claude Desktop/Cowork config

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

9 */

11const fs = require('fs');

12const path = require('path');

13const os = require('os');

14const { execFileSync } = require('child_process');

16const { repairElectron } = require('../src/sidecar/electron-install');

17const HINTS = require('../src/utils/remediation-hints');

18const { isAmicusMcpConfig } = require('../src/utils/mcp-self-identity');

20const SETUP_HOOKS_SCRIPT = path.join(__dirname, 'setup-hooks.js');

22/** Short cache-only provision budget: a slow disk must never hang the install. */

23const PROVISION_TIMEOUT_MS = 15000;

25const SKILL_SOURCE = path.join(__dirname, '..', 'skills', 'sidecar', 'SKILL.md');

src/sidecar/electron-install.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.0.0 matchedPath = src/sidecar/electron-install.js matchedIdentity = npm:YW1pY3Vz:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/electron-install.jsView on unpkg

src/mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.1.0 matchedPath = src/mcp-server.js matchedIdentity = npm:YW1pY3Vz:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/sidecar/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.0.0 matchedPath = src/sidecar/interactive.js matchedIdentity = npm:YW1pY3Vz:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/sidecar/unzip.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.0.0 matchedPath = src/sidecar/unzip.js matchedIdentity = npm:YW1pY3Vz:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/headless.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.0.0 matchedPath = src/headless.js matchedIdentity = npm:YW1pY3Vz:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

10// Load API keys from all sources: process.env > amicus .env > auth.json L11: const { loadCredentials } = require('../src/utils/env-loader'); L12: loadCredentials();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

scripts/postinstall.jsView file

5Install-time AI-agent control hijack evidence: L5: * L6: * 1. Copies SKILL.md to ~/.claude/skills/sidecar/ L7: * 2. Registers MCP server in Claude Code (~/.claude.json) L8: * 3. Registers MCP server in Claude Desktop/Cowork config ... L37: function skillsRoot() { L38: return path.join(os.homedir(), '.claude', 'skills'); L39: } ... L70: L71: if (!existing.mcpServers) { existing.mcpServers = {}; } L72: L73: const prev = existing.mcpServers[name]; L74: const nextConfig = (prev && isAmicusMcpConfig(prev)) ? { ...prev, ...config } : config; Payload evidence from skills/sidecar/SKILL.md: L41: 1. **ALWAYS launch amicus CLI commands with the Bash tool's `run_in_background: true`.** Never run `amicus start/resume/continue` in the foreground. L42: 2. **The fold summary returns on stdout** when the user clicks Fold in the GUI or the headless agent finishes. Use TaskOutput to read it when the background task completes. L43: 3. **For long or multi-line briefings, write them to a temp file and pass `--prompt-file <path>`** (mutually exclusive with `--prompt`; avoids shell-quoting hazards and argument-si... ... L82: **Step 1: Get an OpenRouter API key** L83: - Sign up at https://openrouter.ai …

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

src/sidecar/electron-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/electron-install.jsView on unpkg

src/mcp-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/sidecar/interactive.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/sidecar/unzip.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/headless.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

Findings

1 Critical6 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritysrc/sidecar/electron-install.js

HighKnown Malware Source Similaritysrc/mcp-server.js

HighKnown Malware Source Similaritysrc/sidecar/interactive.js

HighKnown Malware Source Similaritysrc/sidecar/unzip.js

HighKnown Malware Source Similaritysrc/headless.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/amicus.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 36-76json

36 },

37 "files": [

38 "bin/",

39 "src/",

40 "electron/",

41 "skills/",

42 "commands/",

43 ".claude-plugin/",

44 "CHANGELOG.md",

45 "scripts/postinstall.js",

46 "scripts/setup-hooks.js"

47 ],

48 "scripts": {

49 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

50 "test": "jest",

51 "test:integration": "jest --testPathIgnorePatterns='\\.worktrees/' --testMatch='**/tests/**/*.integration.test.js'",

52 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='\\.worktrees/' && node scripts/mark-test-passed.js",

53 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

54 "posttest": "node scripts/mark-test-passed.js",

55 "lint": "eslint src/",

56 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "test:thinking": "node scripts/benchmark-thinking.js",

58 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

59 "refresh-models": "node bin/amicus.js models --refresh",

60 "models:info": "node bin/amicus.js models",

61 "models:check": "node bin/amicus.js models --check",

62 "generate-icon": "node scripts/generate-icon.js",

63 "generate-docs": "node scripts/generate-docs.js",

64 "generate-docs:check": "node scripts/generate-docs.js --check",

65 "validate-docs": "node scripts/validate-docs.js --full",

66 "setup-hooks": "node scripts/setup-hooks.js",

67 "check:secrets": "node scripts/check-secrets.js --all",

68 "check:sizes": "node scripts/check-file-sizes.js --all",

69 "check:tarball": "node scripts/check-tarball-lifecycle.js"

70 },

71 "dependencies": {

72 "@modelcontextprotocol/sdk": "^1.27.0",

73 "@opencode-ai/sdk": "^1.1.36",

74 "dotenv": "^17.2.3",

75 "opencode-ai": "^1.2.20",

76 "tiktoken": "^1.0.0",

bin/amicus.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

10// Load API keys from all sources: process.env > amicus .env > auth.json

11const { loadCredentials } = require('../src/utils/env-loader');

12loadCredentials();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

14const { parseArgs, getUsage, getCommandNames } = require('../src/cli');

15const { handleSetup, handleAbort, handleUpdate, handleMcp, handleKey } = require('../src/cli-handlers');

16const { handleStart, handleFanout, handleRead } = require('../src/cli-handlers-run');

17const { handleResume, handleContinue } = require('../src/cli-handlers-resume-continue');

18const { isOneShotCommand, armExitWatchdog } = require('../src/utils/lifecycle');

19const { suggestCommand } = require('../src/utils/input-validators');

20const { logger } = require('../src/utils/logger');

22const VERSION = require('../package.json').version;

24async function main() {

25 const args = parseArgs(process.argv.slice(2));

26 const command = args._[0];

28 // Install crash handler for MCP-spawned processes (have --task-id)

29 if (args['task-id'] && (command === 'start' || command === 'continue')) {

30 const { installCrashHandler } = require('../src/sidecar/crash-handler');

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3/**

4 * Post-install script for amicus

5 *

6 * 1. Copies SKILL.md to ~/.claude/skills/sidecar/

7 * 2. Registers MCP server in Claude Code (~/.claude.json)

8 * 3. Registers MCP server in Claude Desktop/Cowork config

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

9 */

11const fs = require('fs');

12const path = require('path');

13const os = require('os');

14const { execFileSync } = require('child_process');

16const { repairElectron } = require('../src/sidecar/electron-install');

17const HINTS = require('../src/utils/remediation-hints');

18const { isAmicusMcpConfig } = require('../src/utils/mcp-self-identity');

20const SETUP_HOOKS_SCRIPT = path.join(__dirname, 'setup-hooks.js');

22/** Short cache-only provision budget: a slow disk must never hang the install. */

23const PROVISION_TIMEOUT_MS = 15000;

25const SKILL_SOURCE = path.join(__dirname, '..', 'skills', 'sidecar', 'SKILL.md');

src/sidecar/electron-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/electron-install.jsView on unpkg

src/mcp-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/sidecar/interactive.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/sidecar/unzip.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/headless.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg