Loading npm security reports…

audit-tools@0.33.1: AI-agent control-surface risk | LPM Firewall

registry / audit-tools / 0.33.1

audit-tools@0.33.1

Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install silently installs and overwrites global AI-agent commands, skills, plugins, and OpenCode configuration. It also modifies the consuming repository's .gitignore.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install (postinstall)

Impact

Persists package-controlled instructions and command configuration across Codex, Claude, OpenCode, and Gemini/Antigravity environments.

Mechanism

unconsented lifecycle deployment to global AI-agent control surfaces

Policy narrative

Installing the package invokes a postinstall that writes package-provided AI-agent prompts and skills into global Codex and Claude locations, merges global OpenCode commands and permissions, and installs Gemini/Antigravity plugins. These foreign control-surface mutations occur without an explicit user command and also modify the consumer repository's .gitignore.

Rationale

The package performs concrete, unconsented postinstall mutation of multiple broad AI-agent control surfaces. This meets the firewall block policy even though no install-time exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsscripts/audit/postinstall.mjsscripts/remediate/postinstall.mjsscripts/shared/install-host-assets.mjsdist/shared/io/gitignoreArtifacts.js~/.codex/skills/audit-code/SKILL.md~/.codex/skills/remediate-code/SKILL.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

wrapper/audit-code-wrapper-lib.mjsView file

274const distUrl = new URL(`file:///${distCliEntry.replace(/\\/g, '/')}`); L275: const cli = await import(distUrl.href); L276: await cli.runCli([process.execPath, distCliEntry, commandName, ...commandArgs]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wrapper/audit-code-wrapper-lib.mjsView on unpkg · L274

dist/audit/orchestrator/reviewPackets.jsView file

119* `isolateAlone`/`onIsolate`/`onBeforeFlush` so behavior — including the L120: * exact stderr wording — is unchanged. L121: */ L122: function chunkPacketTasks(tasks, options) { L123: const verbose = Boolean(process.env.AUDIT_CODE_VERBOSE); L124: const sortedTasks = tasks.sort(compareTasksForPacket); ... L137: const taskEstimatedTokens = taskContentTokens(task, options.sizeIndex, options.lineIndex); L138: process.stderr.write(`[audit-code:packet-planning] isolated large-file chunk: task="${task.task_id}" file="${task.file_paths[0]}" estimatedTokens=${taskEstimatedTokens} targetPacke... L139: },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/audit/orchestrator/reviewPackets.jsView on unpkg · L119

dist/shared/quota/errorParsing.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = audit-tools@0.33.0 matchedIdentity = npm:YXVkaXQtdG9vbHM:0.33.0 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/quota/errorParsing.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 20-60json

20 },

21 "./package.json": "./package.json"

22 },

23 "files": [

24 "dist/**",

25 "audit-code.mjs",

26 "wrapper/**",

27 "remediate-code.mjs",

28 "dispatch/**",

29 "schemas/**",

30 "skills/**",

31 "scripts/postinstall.mjs",

32 "scripts/audit/postinstall.mjs",

33 "scripts/remediate/postinstall.mjs",

34 "scripts/shared/install-host-assets.mjs",

35 "opencode.json",

36 "README.md",

37 "docs/audit-pkg/**"

38 ],

39 "scripts": {

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "build": "tsc -p tsconfig.json && node scripts/shared/copy-data-assets.mjs",

42 "check": "tsc -p tsconfig.json --noEmit",

43 "test:doc-contract": "vitest run tests/audit/release-contract.test.mjs tests/audit/file-lock-doc-sync.test.mjs tests/audit/host-asset-renderer-drift.test.mjs",

44 "test": "npm run build && vitest run",

45 "test:single": "npm run build && vitest run",

46 "verify:guards": "vitest run --retry=2 --exclude \"**/audit-code-completion.test.mjs\" --exclude \"**/audit-code-wrapper.test.mjs\" --exclude \"**/audit/next-step.test.mjs\" --exclude \"**/seam-host-only-next-step.test.mjs\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\"",

47 "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:deadcode check:doc-manifest build verify:hosts verify:remediate-hosts smoke:packaged-audit-code smoke:packaged-remediate-code",

48 "verify:release": "npm run verify:checks && vitest run",

49 "check:deadcode": "knip --no-config-hints",

50 "check:doc-manifest": "node scripts/check-doc-manifest.mjs",

51 "verify:hosts": "node scripts/audit/verify-hosts.mjs",

52 "verify:remediate-hosts": "node scripts/remediate/verify-hosts.mjs",

53 "smoke:linked-audit-code": "node scripts/audit/smoke-linked-audit-code.mjs",

54 "smoke:packaged-audit-code": "node scripts/audit/smoke-packaged-audit-code.mjs",

55 "smoke:linked-remediate-code": "node scripts/remediate/smoke-linked-remediate-code.mjs",

56 "smoke:packaged-remediate-code": "node scripts/remediate/smoke-packaged-remediate-code.mjs",

57 "update-languages": "node scripts/audit/update-languages.mjs",

58 "update-models": "node scripts/shared/update-models.mjs",

59 "generate-schemas": "node scripts/audit/generate-schemas.mjs",

60 "fixtures:auditor-contract": "node scripts/remediate/generate-auditor-contract-fixture.mjs",

wrapper/audit-code-wrapper-lib.mjsView file

Lines 254-294javascript

254 // Gate the mkdir behind the same ensureArtifactsDir flag as runDistCommand so

255 // "the artifacts directory is created only for designated stateful commands"

256 // holds on this path too (CE-001); mcp is a designated stateful command and

257 // opts in explicitly at its call site.

258 if (ensureArtifactsDir) {

259 await mkdir(artifactsDir, { recursive: true

dist/audit/orchestrator/reviewPackets.jsView file

Lines 99-139javascript

99 if (!scores || scores.size === 0)

100 return undefined;

101 return new Map(packets.map((

dist/shared/quota/errorParsing.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = audit-tools@0.33.0 matchedIdentity = npm:YXVkaXQtdG9vbHM:0.33.0 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/quota/errorParsing.jsView on unpkg