Loading npm security reports…

amicus@4.8.1: AI-agent control-surface risk | LPM Firewall

registry / amicus / 4.8.1

amicus@4.8.1

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates Claude Code and Claude Desktop/Cowork MCP configuration and installs skills. The resulting agent configuration launches an unpinned latest package through npx.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of amicus@4.8.1

Impact

Unconsented persistent modification of broad Claude agent control surfaces; future agent launches can fetch and execute amicus@latest.

Mechanism

automatic AI-agent skill and MCP registration

Policy narrative

Installing the package automatically executes postinstall, which installs Claude skills and registers an MCP server in both Claude Code and Claude Desktop/Cowork configuration. The registered command is npx -y amicus@latest mcp, so later agent startup can retrieve and run a moving latest version rather than the installed, reviewed version. This is an unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

Source inspection confirms the scanner’s critical finding: postinstall mutates external Claude agent configuration and installs skills, with a moving npx@latest command. This meets the install-control-surface block boundary.

Evidence

package.jsonscripts/postinstall.jssrc/utils/claude-register.jssrc/utils/env-loader.jssrc/sidecar/electron-install.js~/.claude.json~/.claude/skills/sidecar/SKILL.md~/.claude/skills/second-opinion/

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

10// Node version guard: fail fast on unsupported Node versions L11: const { checkNodeVersion } = require('../src/utils/node-version-guard'); L12: const _nv = checkNodeVersion(process.version);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

src/utils/claude-register.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L8: * (src/cli-handlers-init.js) — e.g. after a failed postinstall, a L9: * plugin-channel / --ignore-scripts install, or to repair deleted ~/.claude L10: * state. ... L47: function skillsRoot() { L48: return path.join(os.homedir(), '.claude', 'skills'); L49: } ... L80: L81: if (!existing.mcpServers) { existing.mcpServers = {}; } L82: L83: const prev = existing.mcpServers[name]; L84: const nextConfig = (prev && isAmicusMcpConfig(prev)) ? { ...prev, ...config } : config; ... L86: Write operation from src/sidecar/electron-install.js: L125: function writePathTxt({ electronDir, platform, fs }) { L126: fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform)); L127: } ... L131: const distDir = path.join(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/utils/claude-register.jsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. erwrite' }, { file: 'manual-orchestration.md', mode: 'overwrite' }, { file: 'model-notes.md', mode: 'if-missing' }, ]; function skillsroot() { return path.join(os.homedir(), '.claude', 'skills'); } const mcp_config = { command: 'npx', args: ['-y', 'amicus@latest', 'mcp'] };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/utils/claude-register.jsView on unpkg

src/sidecar/unzip.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/sidecar/unzip.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/mcp-server.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/sidecar/electron-install.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/sidecar/electron-install.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/electron-install.jsView on unpkg

src/utils/engine-install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/utils/engine-install-scan.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/engine-install-scan.jsView on unpkg

src/sidecar/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/sidecar/interactive.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 39-79json

39 "src/",

40 "schemas/",

41 "electron/",

42 "skills/",

43 "commands/",

44 ".claude-plugin/",

45 "CHANGELOG.md",

46 "docs/*.md",

47 "scripts/postinstall.js",

48 "scripts/setup-hooks.js"

49 ],

50 "scripts": {

51 "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",

52 "test": "jest",

53 "test:integration": "node scripts/run-integration-keyless.js",

54 "test:integration:live": "jest --runInBand --testPathIgnorePatterns='worktrees' --testMatch='**/tests/**/*.integration.test.js'",

55 "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='worktrees' && node scripts/mark-test-passed.js",

56 "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",

57 "posttest": "node scripts/mark-test-passed.js",

58 "lint": "eslint src/ electron/ tests/helpers/",

59 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "test:thinking": "node scripts/benchmark-thinking.js",

61 "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",

62 "refresh-models": "node bin/amicus.js models --refresh",

63 "models:info": "node bin/amicus.js models",

64 "models:check": "node bin/amicus.js models --check",

65 "models:check:strict": "node bin/amicus.js models --check --strict",

66 "check:ci-alias-pins": "node scripts/check-ci-alias-pins.js",

67 "generate-icon": "node scripts/generate-icon.js",

68 "generate-docs": "node scripts/generate-docs.js",

69 "generate-docs:check": "node scripts/generate-docs.js --check",

70 "validate-docs": "node scripts/validate-docs.js --full",

71 "setup-hooks": "node scripts/setup-hooks.js",

72 "graphify:index": "graphify extract . --backend claude-cli",

73 "check:secrets": "node scripts/check-secrets.js --all",

74 "check:sizes": "node scripts/check-file-sizes.js --all",

75 "check:citations": "node scripts/check-citations.js --all",

76 "check:tarball": "node scripts/check-tarball-lifecycle.js"

77 },

78 "dependencies": {

79 "@electron/get": "^5.0.0",

bin/amicus.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2

3/**

4 * Amicus CLI Entry Point

5 *

6 * Spec Reference: §4 CLI Interface

7 * Routes commands to appropriate handlers.

8 */

9

10// Node version guard: fail fast on unsupported Node versions

11const { checkNodeVersion } =

src/utils/claude-register.jsView file

Lines 1-21javascript

1/**

2 * @module claude-register

3 * Registration core for amicus: skill install (chat skill + LLM Council),

4 * MCP server registration in Claude Code / Claude Desktop, and legacy MCP

5 * migration. Extracted from scripts/postinstall.js (Task 15, v4.2 §4.8/C2) so

6 * the SAME core can run at `npm install` time (via postinstall.js, now a

7 * thin re-exporting consumer of this module) AND on demand via `amicus init`

8 * (src/cli-handlers-init.js) — e.g. after a failed postinstall, a

9 * plugin-channel / --ignore-scripts install, or to repair deleted ~/.claude

src/sidecar/unzip.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/sidecar/unzip.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/mcp-server.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/sidecar/electron-install.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/sidecar/electron-install.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/electron-install.jsView on unpkg

src/utils/engine-install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/utils/engine-install-scan.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/engine-install-scan.jsView on unpkg

src/sidecar/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.7.1 matchedPath = src/sidecar/interactive.js matchedIdentity = npm:YW1pY3Vz:4.7.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg