Loading npm security reports…

amicus@4.9.4: AI-agent control-surface risk | LPM Firewall

registry / amicus / 4.9.4

amicus@4.9.4

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes Claude Code and Claude Desktop/Cowork user configuration and installs Claude skills. The registered MCP command later invokes an unpinned latest release through npx.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; starting the registered MCP server triggers npx.

Impact

A dependency installation changes a broad AI-agent control surface without an explicit setup command and creates a future dynamic execution path.

Mechanism

Automatic user-level AI-agent configuration mutation and unpinned MCP launcher registration.

Policy narrative

On installation, the postinstall hook installs skills and registers an amicus MCP server in user-wide Claude configuration. The registration writes configuration files and sets the server command to npx -y amicus@latest mcp. This changes an external AI-agent control surface without requiring the user to run an explicit setup command, and it allows a later unpinned package release to execute when the MCP server is launched.

AI rationale

This is concrete automatic postinstall mutation of foreign, user-wide AI-agent configuration, which the policy requires blocking. The opt-out variable and error handling do not establish prior consent.

Evidence

package.jsonscripts/postinstall.jssrc/utils/claude-register.js~/.claude/skills/sidecar/SKILL.md~/.claude/skills/second-opinion/~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

10// Node version guard: fail fast on unsupported Node versions L11: const { checkNodeVersion } = require('../src/utils/node-version-guard'); L12: const _nv = checkNodeVersion(process.version);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

src/utils/claude-register.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L8: * (src/cli-handlers-init.js) — e.g. after a failed postinstall, a L9: * plugin-channel / --ignore-scripts install, or to repair deleted ~/.claude L10: * state. ... L47: function skillsRoot() { L48: return path.join(os.homedir(), '.claude', 'skills'); L49: } ... L80: L81: if (!existing.mcpServers) { existing.mcpServers = {}; } L82: L83: const prev = existing.mcpServers[name]; L84: const nextConfig = (prev && isAmicusMcpConfig(prev)) ? { ...prev, ...config } : config; ... L86: Write operation from src/sidecar/electron-install.js: L125: function writePathTxt({ electronDir, platform, fs }) { L126: fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform)); L127: } ... L131: const distDir = path.join(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/utils/claude-register.jsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. erwrite' }, { file: 'manual-orchestration.md', mode: 'overwrite' }, { file: 'model-notes.md', mode: 'if-missing' }, ]; function skillsroot() { return path.join(os.homedir(), '.claude', 'skills'); } const mcp_config = { command: 'npx', args: ['-y', 'amicus@latest', 'mcp'] };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/utils/claude-register.jsView on unpkg

electron/setup-ui.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

electron/setup-ui.js#virtual:normalized:round1View on unpkg

src/sidecar/unzip.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/sidecar/unzip.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/unzip.jsView on unpkg

src/sidecar/electron-install.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/sidecar/electron-install.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/electron-install.jsView on unpkg

src/utils/engine-install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/utils/engine-install-scan.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/engine-install-scan.jsView on unpkg

src/observe/on-complete.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/observe/on-complete.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/observe/on-complete.jsView on unpkg

src/sidecar/setup-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/sidecar/setup-window.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/setup-window.jsView on unpkg

src/sidecar/workspace-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/sidecar/workspace-window.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/workspace-window.jsView on unpkg

src/utils/updater.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/utils/updater.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/updater.jsView on unpkg

src/utils/update-notice.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.1 matchedPath = src/utils/update-notice.js matchedIdentity = npm:YW1pY3Vz:4.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-notice.jsView on unpkg

src/mcp-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = amicus@4.9.2 matchedIdentity = npm:YW1pY3Vz:4.9.2 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/mcp-server.jsView on unpkg