Loading npm security reports…

amicus@4.9.5: AI-agent control-surface risk | LPM Firewall

registry / amicus / 4.9.5

amicus@4.9.5

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies user-wide Claude skills and MCP configuration. The registered MCP command resolves the latest Amicus release when Claude launches it.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall.

Impact

A package install can alter Claude Code and Claude Desktop control surfaces and arrange later execution of a registry-resolved release.

Mechanism

Automatic user-wide AI-agent configuration mutation and latest-version MCP registration.

Policy narrative

On npm installation, the postinstall script installs package-provided Claude skills and registers an MCP server in user-wide Claude Code and Claude Desktop configuration. The registration points to npx -y amicus@latest mcp, so a later agent launch can resolve a newer registry release rather than the installed package version. The config writer can replace a non-Amicus entry under the reserved amicus key. This is unconsented install-time mutation of broad AI-agent control surfaces.

AI rationale

The automatic postinstall modifies foreign, user-wide AI-agent configuration and installs an MCP command that resolves the latest release at launch. This meets the install-control-surface block policy despite the package’s consumer-repository Git-hook guard.

Evidence

package.jsonscripts/postinstall.jssrc/utils/claude-register.js~/.claude/skills/sidecar/SKILL.md~/.claude/skills/second-opinion/~/.claude.json

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

10// Node version guard: fail fast on unsupported Node versions L11: const { checkNodeVersion } = require('../src/utils/node-version-guard'); L12: const _nv = checkNodeVersion(process.version);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

src/utils/claude-register.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L8: * (src/cli-handlers-init.js) — e.g. after a failed postinstall, a L9: * plugin-channel / --ignore-scripts install, or to repair deleted ~/.claude L10: * state. ... L47: function skillsRoot() { L48: return path.join(os.homedir(), '.claude', 'skills'); L49: } ... L80: L81: if (!existing.mcpServers) { existing.mcpServers = {}; } L82: L83: const prev = existing.mcpServers[name]; L84: const nextConfig = (prev && isAmicusMcpConfig(prev)) ? { ...prev, ...config } : config; ... L86: Write operation from src/sidecar/electron-install.js: L124: function writePathTxt({ electronDir, platform, fs }) { L125: fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform)); L126: } ... L130: const distDir = path.join(

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/utils/claude-register.jsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. erwrite' }, { file: 'manual-orchestration.md', mode: 'overwrite' }, { file: 'model-notes.md', mode: 'if-missing' }, ]; function skillsroot() { return path.join(os.homedir(), '.claude', 'skills'); } const mcp_config = { command: 'npx', args: ['-y', 'amicus@latest', 'mcp'] };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/utils/claude-register.jsView on unpkg

electron/setup-ui.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 34

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

electron/setup-ui.js#virtual:normalized:round1View on unpkg

src/mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/mcp-server.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/utils/engine-install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/utils/engine-install-scan.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/engine-install-scan.jsView on unpkg

src/sidecar/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/sidecar/interactive.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/headless.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/headless.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

src/observe/on-complete.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/observe/on-complete.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/observe/on-complete.jsView on unpkg

src/opencode-client.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/opencode-client.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/opencode-client.jsView on unpkg

src/sidecar/setup-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/sidecar/setup-window.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/setup-window.jsView on unpkg

src/sidecar/workspace-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/sidecar/workspace-window.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/workspace-window.jsView on unpkg

src/utils/updater.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/utils/updater.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/updater.jsView on unpkg

src/cli-handlers-doctor.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/cli-handlers-doctor.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli-handlers-doctor.jsView on unpkg

src/utils/update-notice.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.4 matchedPath = src/utils/update-notice.js matchedIdentity = npm:YW1pY3Vz:4.9.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-notice.jsView on unpkg

src/sidecar/unzip.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = amicus@4.9.2 matchedIdentity = npm:YW1pY3Vz:4.9.2 similarity = 0.725 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/sidecar/unzip.jsView on unpkg