Loading npm security reports…

audit-tools@0.50.13: AI-agent control-surface risk | LPM Firewall

registry / audit-tools / 0.50.13

audit-tools@0.50.13

Provider-neutral code auditing and remediation workflows for arbitrary repositories.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically writes and updates global Codex, Claude, OpenCode, and Gemini agent assets. It also modifies the consuming repository's .gitignore.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation executes postinstall

Impact

Package-controlled prompts and permissions become available in unrelated agent hosts without an explicit setup command.

Mechanism

Automatic mutation of global AI-agent commands, skills, plugins, and configuration

Policy narrative

On npm installation, the package runs two postinstall deployers. They copy package-controlled skills and prompts into global Codex and Claude locations, add plugins for Gemini, and merge commands and permissions into OpenCode's global configuration. The same lifecycle path writes a managed block into the consumer repository's .gitignore. These changes occur without an explicit user setup command and affect foreign AI-agent control surfaces.

Rationale

The automatic postinstall hook makes broad, persistent changes to multiple global AI-agent control surfaces and the consumer project. This meets the install-hook abuse policy even though no secret exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsscripts/audit/postinstall.mjsscripts/remediate/postinstall.mjsscripts/shared/install-host-assets.mjsdist/shared/io/gitignoreArtifacts.js

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

wrapper/audit-code-wrapper-lib.mjsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = wrapper/audit-code-wrapper-lib.mjs matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wrapper/audit-code-wrapper-lib.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0991bd8a58b15fe7 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = audit-tools@0.50.12 matchedPath = wrapper/audit-code-wrapper-lib.mjs matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 shingleOverlap = 93 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

wrapper/audit-code-wrapper-lib.mjsView on unpkg

340const distUrl = new URL(`file:///${distCliEntry.replace(/\\/g, '/')}`); L341: const cli = await import(distUrl.href); L342: await cli.runCli([process.execPath, distCliEntry, commandName, ...commandArgs]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wrapper/audit-code-wrapper-lib.mjsView on unpkg · L340

scripts/audit/postinstall.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L159: grep: 'allow', L160: edit: { ...OPENCODE_AUDIT_EDIT_PERMISSION }, L161: bash: { ...OPENCODE_AUDIT_BASH_PERMISSION }, L162: }; ... L204: function claudePluginExternalDir() { L205: return join(homedir(), '.claude', 'plugins', 'marketplaces', 'claude-plugins-official', 'external_plugins', 'audit-code'); L206: } ... L222: label: 'Claude command', L223: path: join(homedir(), '.claude', 'commands', 'audit-code.md'), L224: sourcePath: promptSourceFile, ... L228: label: 'Codex skill', L229: path: join(homedir(), '.codex', 'skills', 'audit-code', 'SKILL.md'), Write operation from scripts/shared/install-host-assets.mjs: L12: import { dirname, join } from "node:path"; L13: import { mkdirSync, existsSync, readFileSync, writeF

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/audit/postinstall.mjsView on unpkg · L1

dist/audit/cli/args.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/cli/args.jsView on unpkg

dist/audit/orchestrator/runtimeCommand.jsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = [redacted].js matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/orchestrator/runtimeCommand.jsView on unpkg

dist/shared/tooling/exec.jsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = dist/shared/tooling/exec.js matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shared/tooling/exec.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = audit-tools@0.50.1 matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.1 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/tooling/exec.jsView on unpkg

wrapper/audit-code-wrapper-build.mjsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = wrapper/audit-code-wrapper-build.mjs matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wrapper/audit-code-wrapper-build.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 22-62json

22 },

23 "files": [

24 "dist/**",

25 "audit-code.mjs",

26 "wrapper/**",

27 "remediate-code.mjs",

28 "dispatch/**",

29 "schemas/**",

30 "skills/**",

31 "scripts/postinstall.mjs",

32 "scripts/audit/postinstall.mjs",

33 "scripts/remediate/postinstall.mjs",

34 "scripts/shared/install-host-assets.mjs",

35 "opencode.json",

36 "README.md",

37 "docs/audit-pkg/product.md",

38 "docs/audit-pkg/operator-guide.md",

39 "docs/audit-pkg/contracts.md"

40 ],

41 "scripts": {

42 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "prebuild": "node scripts/shared/guard-no-suite-running.mjs",

44 "build": "node scripts/shared/clean-dist.mjs && tsc -p tsconfig.json",

45 "check": "tsc -p tsconfig.json --noEmit",

46 "check:tests": "tsc -p tsconfig.test.json",

47 "check:scripts": "tsc -p tsconfig.scripts.json",

48 "nightly:inbox": "node scripts/nightly/render-inbox.mjs",

49 "nightly:ingest": "node scripts/nightly/ingest-answers.mjs",

50 "test:doc-contract": "node scripts/shared/run-vitest-gate.mjs tests/audit/release-contract.test.ts tests/audit/file-lock-doc-sync.test.ts tests/audit/host-asset-renderer-drift.test.ts tests/shared/handoff-roadmap.test.ts",

51 "test": "npm run build && node scripts/shared/run-vitest-gate.mjs",

52 "test:single": "npm run build && node scripts/shared/run-vitest-gate.mjs",

53 "verify:guards": "node scripts/shared/run-vitest-gate.mjs --retry=2 --exclude \"**/audit-code-completion-*.test.ts\" --exclude \"**/audit-code-wrapper-*.test.ts\" --exclude \"**/audit/next-step-core-*.test.ts\" --exclude \"**/seam-host-only-next-step.test.ts\" --exclude \"**/*-e2e.test.*\" --exclude \"**/next-step-implement-dispatch.test.ts\" --exclude \"**/next-step-pipeline-dispatch.test.ts\""

54 "verify:checks": "node scripts/shared/profile-run.mjs verify-checks check:control-bytes check:shared-primitives check:version-gates check:guard-reach check:ci-trigger-paths check:offload-lanes check:loop-core-patterns check:constitutional-doc-paths check:runtime-artifact-names check:executor-producers check:spec-mirrors check:cli-surface check:deadcode check:lint check:dup check:depgraph check:doc-manifest check:doc-links check:doc-code-citations check:gate-enumeration check:philosophy-brief check:readme-sample-report check:proposal-red-at check:nightly-routine-prompt check:handoff-roadmap ...

55 "verify:release": "npm run verify:checks && node scripts/shared/run-vitest-gate.mjs && npm run smoke:linked-audit-code && npm run smoke:linked-remediate-code",

56 "check:control-bytes": "node scripts/check-control-bytes.mjs",

57 "check:shared-primitives": "node scripts/check-shared-primitives.mjs",

58 "check:guard-reach": "node scripts/check-guard-reach.mjs",

59 "closeout": "node scripts/render-closeout.mjs",

60 "check:ci-trigger-paths": "node scripts/shared/generate-ci-trigger-paths.mjs --check",

61 "check:deadcode": "knip --no-config-hints",

62 "check:lint": "eslint .",

Long lines were clipped for display.

wrapper/audit-code-wrapper-lib.mjsView file

Lines 320-360javascript

320 // Gate the mkdir behind the same ensureArtifactsDir flag as runDistCommand so

321 // "the artifacts directory is created only for designated stateful commands"

322 // holds on this path too (CE-001); mcp is a designated stateful command and

323 // opts in explicitly at its call site.

324 if (ensureArtifactsDir) {

325 await mkdir(artifactsDir, { recursive: true

scripts/audit/postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { homedir } from 'os';

3import { join, dirname } from 'path';

4import { readFileSync } from 'fs';

5import { fileURLToPath } from

dist/audit/cli/args.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/audit/cli/args.jsView on unpkg

dist/audit/orchestrator/runtimeCommand.jsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = [redacted].js matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/audit/orchestrator/runtimeCommand.jsView on unpkg

dist/shared/tooling/exec.jsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = dist/shared/tooling/exec.js matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/shared/tooling/exec.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = audit-tools@0.50.1 matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.1 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/tooling/exec.jsView on unpkg

wrapper/audit-code-wrapper-build.mjsView file

•matchType = normalized_sha256 matchedPackage = audit-tools@0.50.12 matchedPath = wrapper/audit-code-wrapper-build.mjs matchedIdentity = npm:YXVkaXQtdG9vbHM:0.50.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wrapper/audit-code-wrapper-build.mjsView on unpkg