Loading npm security reports…

amicus@4.9.6: Malicious npm security report (Block) | LPM Firewall

registry / amicus / 4.9.6

amicus@4.9.6

Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package automatically changes user-level Claude agent configuration. The installed MCP entry invokes the latest amicus release through npx when the agent starts it.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall; a configured Claude client later starts the MCP server.

Impact

A dependency install persists control over Claude Code and Claude Desktop/Cowork execution through a future registry release.

Mechanism

Automatic user-scope MCP registration with a mutable npx latest command.

Attack narrative

On installation, the postinstall script registers amicus in user-level Claude Code and Claude Desktop configuration. That registration runs npx -y amicus@latest mcp, so future agent launches can fetch and execute a different package release. The installer also replaces the reserved amicus MCP entry in those configuration files. This is an unconsented lifecycle mutation of broad AI-agent control surfaces with a mutable self-update execution chain.

AI rationale

The package automatically persists a user-scope AI-agent command rather than requiring an explicit setup action. Its npx latest registration makes the installed control surface execute a future release selected at runtime.

Evidence

package.jsonscripts/postinstall.jssrc/utils/claude-register.js~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json~/.config/claude/claude_desktop_config.json

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/amicus.jsView file

10// Node version guard: fail fast on unsupported Node versions L11: const { checkNodeVersion } = require('../src/utils/node-version-guard'); L12: const _nv = checkNodeVersion(process.version);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/amicus.jsView on unpkg · L10

src/utils/claude-register.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L8: * (src/cli-handlers-init.js) — e.g. after a failed postinstall, a L9: * plugin-channel / --ignore-scripts install, or to repair deleted ~/.claude L10: * state. ... L47: function skillsRoot() { L48: return path.join(os.homedir(), '.claude', 'skills'); L49: } ... L80: L81: if (!existing.mcpServers) { existing.mcpServers = {}; } L82: L83: const prev = existing.mcpServers[name]; L84: const nextConfig = (prev && isAmicusMcpConfig(prev)) ? { ...prev, ...config } : config; ... L86: Write operation from src/sidecar/electron-layout.js: L46: function writePathTxt({ electronDir, platform, fs }) { L47: fs.writeFileSync(path.join(electronDir, 'path.txt'), platformExe(platform)); L48: } ... L233: } catch (e) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/utils/claude-register.jsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. erwrite' }, { file: 'manual-orchestration.md', mode: 'overwrite' }, { file: 'model-notes.md', mode: 'if-missing' }, ]; function skillsroot() { return path.join(os.homedir(), '.claude', 'skills'); } const mcp_config = { command: 'npx', args: ['-y', 'amicus@latest', 'mcp'] };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/utils/claude-register.jsView on unpkg

electron/setup-ui.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 37

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

electron/setup-ui.js#virtual:normalized:round1View on unpkg

src/mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/mcp-server.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp-server.jsView on unpkg

src/utils/engine-install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/utils/engine-install-scan.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/engine-install-scan.jsView on unpkg

src/sidecar/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/sidecar/interactive.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/interactive.jsView on unpkg

src/headless.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/headless.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/headless.jsView on unpkg

src/observe/on-complete.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/observe/on-complete.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/observe/on-complete.jsView on unpkg

src/opencode-client.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/opencode-client.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/opencode-client.jsView on unpkg

src/sidecar/setup-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/sidecar/setup-window.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/setup-window.jsView on unpkg

src/sidecar/workspace-window.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/sidecar/workspace-window.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/sidecar/workspace-window.jsView on unpkg

src/utils/updater.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/utils/updater.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/updater.jsView on unpkg

src/cli-handlers-doctor.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/cli-handlers-doctor.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli-handlers-doctor.jsView on unpkg

src/utils/update-notice.jsView file

•matchType = normalized_sha256 matchedPackage = amicus@4.9.5 matchedPath = src/utils/update-notice.js matchedIdentity = npm:YW1pY3Vz:4.9.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-notice.jsView on unpkg

src/sidecar/unzip.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = amicus@4.9.2 matchedIdentity = npm:YW1pY3Vz:4.9.2 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/sidecar/unzip.jsView on unpkg