Loading npm security reports…

amicus@3.2.1: AI-agent policy block | LPM Firewall

registry / amicus / 3.2.1

amicus@3.2.1

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code modifies global Claude Code and Claude Desktop/Cowork control files without an explicit setup command. It also persists package-supplied skills and configures a host-launched MCP command resolving `amicus@latest`.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, followed by Claude host MCP startup

Impact

Persists package-controlled instructions and a dynamically resolved MCP process in broad user-level AI-agent surfaces.

Mechanism

global AI-agent skill and MCP configuration mutation

Policy narrative

On package installation, the postinstall script copies Amicus skill instructions into the user-wide Claude skills directory and edits Claude Code plus Claude Desktop/Cowork MCP configuration. The registered server launches `npx -y amicus@latest mcp`, so a future agent-host startup resolves and executes the latest registry version rather than the installed package version. The script also replaces a foreign entry using the reserved `amicus` MCP name. These are unconsented install-time mutations of broad external AI-agent control surfaces.

Rationale

Direct source inspection confirms an automatic postinstall persistence chain into user-wide Claude control surfaces, not merely scanner similarity. This meets the block boundary for unconsented lifecycle mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsonscripts/postinstall.jsskills/sidecar/SKILL.mdskills/second-opinion/SKILL.md.claude-plugin/plugin.json~/.claude/skills/sidecar/SKILL.md

Source & flagged code

9 flagged

package.jsonView file

Lines 36-76json

36 },

37 "files": [

38 "bin/",

39 "src/",

40 "electron/",

41 "skills/",

42 "commands/",

43 ".claude-plugin/",

44 "CHANGELOG.md",

45 "scripts/postinstall.js",

46 "scripts/setup-hooks.js"

47 ],

48 "scripts": {

49 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

50 "test": "jest",

51 "test:integration": "jest --testPathIgnorePatterns='\\.worktrees/' --testMatch='**/tests/**/*.integration.test.js'",

52 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='\\.worktrees/' && node scripts/mark-test-passed.js",

53 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

54 "posttest": "node scripts/mark-test-passed.js",

55 "lint": "eslint src/",

56 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "test:thinking": "node scripts/benchmark-thinking.js",

58 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

59 "refresh-models": "node bin/amicus.js models --refresh",

60 "models:info": "node bin/amicus.js models",

61 "models:check": "node bin/amicus.js models --check",

62 "models:check:strict": "node bin/amicus.js models --check --strict",

63 "generate-icon": "node scripts/generate-icon.js",

64 "generate-docs": "node scripts/generate-docs.js",

65 "generate-docs:check": "node scripts/generate-docs.js --check",

66 "validate-docs": "node scripts/validate-docs.js --full",

67 "setup-hooks": "node scripts/setup-hooks.js",

68 "check:secrets": "node scripts/check-secrets.js --all",

69 "check:sizes": "node scripts/check-file-sizes.js --all",

70 "check:tarball": "node scripts/check-tarball-lifecycle.js"

71 },

72 "dependencies": {

73 "@electron/get": "^5.0.0",

74 "@modelcontextprotocol/sdk": "^1.27.0",

75 "@opencode-ai/sdk": "^1.1.36",

76 "dotenv": "^17.2.3",

bin/amicus.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

10// Node version guard: fail fast on unsupported Node versions

11const { checkNodeVersion } =

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3/**

4 * Post-install script for amicus

5 *

6 * 1. Copies SKILL.md to ~/.claude/skills/sidecar/

7 * 2. Registers MCP server in Claude Code (~/.claude.json)

8 * 3. Registers MCP server in Claude Desktop/Cowork config

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

9 */

src/sidecar/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.2.0 matchedPath = src/sidecar/interactive.js matchedIdentity = npm:YW1pY3Vz:2.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/sidecar/unzip.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.2.0 matchedPath = src/sidecar/unzip.js matchedIdentity = npm:YW1pY3Vz:2.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/headless.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.2.0 matchedPath = src/headless.js matchedIdentity = npm:YW1pY3Vz:2.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

src/sidecar/setup-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.2.0 matchedPath = src/sidecar/setup-window.js matchedIdentity = npm:YW1pY3Vz:2.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/setup-window.jsView on unpkg

src/utils/updater.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@2.2.0 matchedPath = src/utils/updater.js matchedIdentity = npm:YW1pY3Vz:2.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/updater.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

10// Node version guard: fail fast on unsupported Node versions L11: const { checkNodeVersion } = require('../src/utils/node-version-guard'); L12: const _nv = checkNodeVersion(process.version);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

scripts/postinstall.jsView file

5Install-time AI-agent control hijack evidence: L5: * L6: * 1. Copies SKILL.md to ~/.claude/skills/sidecar/ L7: * 2. Registers MCP server in Claude Code (~/.claude.json) L8: * 3. Registers MCP server in Claude Desktop/Cowork config ... L37: function skillsRoot() { L38: return path.join(os.homedir(), '.claude', 'skills'); L39: } ... L70: L71: if (!existing.mcpServers) { existing.mcpServers = {}; } L72: L73: const prev = existing.mcpServers[name]; L74: const nextConfig = (prev && isAmicusMcpConfig(prev)) ? { ...prev, ...config } : config; Payload evidence from skills/sidecar/SKILL.md: L41: 1. **ALWAYS launch amicus CLI commands with the Bash tool's `run_in_background: true`.** Never run `amicus start/resume/continue` in the foreground. L42: 2. **The fold summary returns on stdout** when the user clicks Fold in the GUI or the headless agent finishes. Use TaskOutput to read it when the background task completes. L43: 3. **For long or multi-line briefings, write them to a temp file and pass `--prompt-file <path>`** (mutually exclusive with `--prompt`; avoids shell-quoting hazards and argument-si... ... L92: **Step 1: Get an OpenRouter API key** L93: - Sign up at https://openrouter.ai …

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

src/sidecar/interactive.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/sidecar/unzip.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/headless.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

src/sidecar/setup-window.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/setup-window.jsView on unpkg

src/utils/updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/updater.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 36-76json

36 },

37 "files": [

38 "bin/",

39 "src/",

40 "electron/",

41 "skills/",

42 "commands/",

43 ".claude-plugin/",

44 "CHANGELOG.md",

45 "scripts/postinstall.js",

46 "scripts/setup-hooks.js"

47 ],

48 "scripts": {

49 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

50 "test": "jest",

51 "test:integration": "jest --testPathIgnorePatterns='\\.worktrees/' --testMatch='**/tests/**/*.integration.test.js'",

52 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='\\.worktrees/' && node scripts/mark-test-passed.js",

53 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

54 "posttest": "node scripts/mark-test-passed.js",

55 "lint": "eslint src/",

56 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "test:thinking": "node scripts/benchmark-thinking.js",

58 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

59 "refresh-models": "node bin/amicus.js models --refresh",

60 "models:info": "node bin/amicus.js models",

61 "models:check": "node bin/amicus.js models --check",

62 "models:check:strict": "node bin/amicus.js models --check --strict",

63 "generate-icon": "node scripts/generate-icon.js",

64 "generate-docs": "node scripts/generate-docs.js",

65 "generate-docs:check": "node scripts/generate-docs.js --check",

66 "validate-docs": "node scripts/validate-docs.js --full",

67 "setup-hooks": "node scripts/setup-hooks.js",

68 "check:secrets": "node scripts/check-secrets.js --all",

69 "check:sizes": "node scripts/check-file-sizes.js --all",

70 "check:tarball": "node scripts/check-tarball-lifecycle.js"

71 },

72 "dependencies": {

73 "@electron/get": "^5.0.0",

74 "@modelcontextprotocol/sdk": "^1.27.0",

75 "@opencode-ai/sdk": "^1.1.36",

76 "dotenv": "^17.2.3",

bin/amicus.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

10// Node version guard: fail fast on unsupported Node versions

11const { checkNodeVersion } =

scripts/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3/**

4 * Post-install script for amicus

5 *

6 * 1. Copies SKILL.md to ~/.claude/skills/sidecar/

7 * 2. Registers MCP server in Claude Code (~/.claude.json)

8 * 3. Registers MCP server in Claude Desktop/Cowork config

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L5

9 */

src/sidecar/interactive.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/sidecar/unzip.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/headless.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

src/sidecar/setup-window.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/setup-window.jsView on unpkg

src/utils/updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/updater.jsView on unpkg

amicus@3.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code