Loading npm security reports…

arreio@1.1.0: AI-agent control-surface risk | LPM Firewall

registry / arreio / 1.1.0

arreio@1.1.0

Arreio transforms agentic coding workflows into a predictable, safe, and high-quality software delivery pipeline. Master the four core phases—Plan, Work, Review, Learn—to orchestrate a highly reliable development cycle.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs code that injects package-controlled AI-agent skills into the consuming project. Existing matching skills are overwritten.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation that permits postinstall scripts

Impact

The package can alter the instructions and capabilities available to an AI coding agent in the consumer project.

Mechanism

recursive install-time copy into the consumer .agents/skills directory

Policy narrative

The postinstall hook executes automatically during installation. It resolves the consumer project through INIT_CWD, creates .agents, and recursively copies the package's skills into .agents/skills. Since copying replaces existing files with the same names, this grants the installed package control over a generic project AI-agent skill surface without an explicit user command.

AI rationale

The package performs an unconsented postinstall write to a broad AI-agent control surface in the consumer project. Although no exfiltration or network activity was found, this concrete lifecycle injection meets the install-control-surface blocking policy.

Evidence

package.jsonscripts/postinstall.jsskills/<consumer-project>/.agents/skills/

Decision evidence

public snapshot

AI identified this as a at 97.0% confidence with false-positive risk.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"scripts": { "postinstall": "node scripts/postinstall.js" }

High

Suspicious Lifecycle Evidence

An npm postinstall hook automatically runs the installer.

package.jsonView on unpkg · L33

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

4* Post-install script for arreio L5: * Copies skills from the package to the project's .agents/skills directory L6: */ ... L17: const projectRoot = process.env.INIT_CWD || process.cwd(); L18: const agentsDir = path.join(projectRoot, '.agents'); L19: const sk[redacted] = path.join(agentsDir, 'skills'); ... L23: if (!fs.existsSync(dest)) { L24: fs.mkdirSync(dest, { recursive: true }); L25: } ... L35: } else { L36: fs.copyFileSync(srcFile, destFile); L37: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L4

15// INIT_CWD is set by npm to the project root during lifecycle scripts. // Fallback to process.cwd() for direct/manual runs. const projectRoot = process.env.INIT_CWD || process.cwd(); const agentsDir = path.join(projectRoot, '.agents'); const sk[redacted] = path.join(agentsDir, 'skills');

High

Ai Review Evidence

The installer targets the consumer project root and creates a generic .agents control directory.

scripts/postinstall.jsView on unpkg · L15

27const files = fs.readdirSync(src); files.forEach(file => { const srcFile = path.join(src, file); const destFile = path.join(dest, file); const stat = fs.statSync(srcFile); if (stat.isDirectory()) { copyDirectory(srcFile, destFile); } else { fs.copyFileSync(srcFile, destFile); } });

High

Ai Review Evidence

It recursively copies all packaged skills into .agents/skills and overwrites matching files without consent.

scripts/postinstall.jsView on unpkg · L27

README.mdView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

README.mdView on unpkg