basinfy@1.0.9: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

basinfy@1.0.9: AI-agent control-surface risk | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/mcp-config.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: 'use strict';const _0x53f5c4=_0x4fc8,_0x10a82f=_0x3800;(function(_0x58238b,_0x59100d){const _0x4cd27f={_0x1de168:'(YB6',_0x18a78e:0x19b,_0x137075:0x17f,_0x2e84bf:0x22a,_0x3335cb:'k... Write operation from scripts/postinstall.js: L55: fs.rmSync(pkgDir, { recursive: true, force: true }); L56: fs.mkdirSync(pkgDir, { recursive: true }); L57: fs.writeFileSync( L58: path.join(pkgDir, 'package.json'), ... L60: ); L61: fs.writeFileSync(indexPath, 'module.exports = {};\n'); L62: } ... L78: ); L79: fs.writeFileSync(tensorJsPath, tensorContent, 'utf8'); L80: } Foreign user/project scope from scripts/postinstall.js: L55: fs.rmSync(pkgDir, { recursive: true, force: true }); L56: fs.mkdirSync(pkgDir, { recursive: true }); L57: fs

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/mcp-config.jsView on unpkg · L1

1'use strict';const _0x53f5c4=_0x4fc8,_0x10a82f=_0x3800;(function(_0x58238b,_0x59100d){const _0x4cd27f={_0x1de168:'(YB6',_0x18a78e:0x19b,_0x137075:0x17f,_0x2e84bf:0x22a,_0x3335cb:'k...

High

Child Process

Package source references child process execution.

dist/cli/mcp-config.jsView on unpkg · L1

bin/basinfy.jsView file

6} L7: const fs = require('fs'); L8: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/basinfy.jsView on unpkg · L6

dist/core/neural-encoder.jsView file

1const _0x902a78=_0x505f,_0x46280c=_0x591d;(function(_0x453603,_0x2939cc){const _0x5f276f={_0x292721:'IieF',_0x5676ca:0x114,_0x4d2e41:'P4gT',_0x17a094:0x144,_0x216cd6:0xdf,_0x500c27...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core/neural-encoder.jsView on unpkg · L1

dist/cli/mcp-config.js#virtual:normalized:round1View file

1"use strict";const _0x53f5c4=_0x4fc8,_0x10a82f=_0x3800;(function(_0x58238b,_0x59100d){const _0x4cd27f={_0x1de168:"(YB6",_0x18a78e:0x19b,_0x137075:0x17f,_0x2e84bf:0x22a,_0x3335cb:"k...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/mcp-config.js#virtual:normalized:round1View on unpkg · L1

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 40161 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 32-72json

32 "build": "npm run build:viz-css && node scripts/clean-dist.js && npx tsc && node scripts/copy-core-artifacts.js && npm run build:mcp",

33 "build:viz-css": "tailwindcss -i src/visualizer/viz.tailwind.css -o src/visualizer/viz.compiled.css --minify",

34 "build:release": "npm run build && node --max-old-space-size=16384 scripts/obfuscate-dist.js --no-spawn",

35 "verify:pack": "node scripts/verify-pack.js",

36 "pack:audit": "node scripts/pack-audit.js",

37 "pack:demo-full": "npm run build:release && node scripts/pack-demo-full.js",

38 "pack:full": "npm run build:release && node scripts/pack-full.js",

39 "pack:light": "npm run build:release && node scripts/pack-light.js",

40 "dev:cli": "node scripts/dev-cli.js",

41 "build:mcp": "cd packages/mcp-server && npm run build",

42 "start": "ts-node src/cli/index.ts",

43 "test": "jest",

44 "benchmark": "ts-node scripts/benchmark.ts",

45 "benchmark:recall-at-k": "ts-node scripts/benchmark-recall-at-k.ts",

46 "benchmark:recall-canvas": "ts-node scripts/generate-recall-canvas-data.ts",

47 "benchmark:calibrate": "ts-node scripts/calibrate-hybrid-weights.ts",

48 "benchmark:calibrate:es": "ts-node scripts/calibrate-es.ts",

49 "benchmark:train:full": "ts-node scripts/train-calibrate-full.ts",

50 "evolve:online": "ts-node scripts/evolve-online.ts",

51 "prepublishOnly": "npm run build:release && npm run verify:pack && npm run pack:audit",

52 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 "dev": "ts-node-dev --respawn --transpile-only src/cli/index.ts"

54 },

55 "keywords": [

56 "ai",

57 "agents",

58 "code-indexing",

59 "knowledge-graph",

60 "claude",

61 "copilot",

62 "cursor",

63 "context-compression",

64 "token-savings"

65 ],

66 "author": "Alex Martins",

67 "license": "SEE LICENSE IN LICENSE",

68 "repository": {

69 "type": "git",

70 "url": "https://basinfy.com"

71 },

72 "dependencies": {

dist/cli/mcp-config.jsView file

Lines 1-1javascript

1'use strict';const _0x53f5c4=_0x4fc8,_0x10a82f=_0x3800;(function(_0x58238b,_0x59100d){const _0x4cd27f={_0x1de168:'(YB6',_0x18a78e:0x19b,_0x137075:0x17f,_0x2e84bf:0x22a,_0x3335cb:

bin/basinfy.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const execArgv = process.execArgv.join(' ');

3if (execArgv.includes('--inspect') || execArgv.includes('--debug') || (process.env.NODE_OPTIONS

dist/core/neural-encoder.jsView file

Lines 1-1javascript

1const _0x902a78=_0x505f,_0x46280c=_0x591d;(function(_0x453603,_0x2939cc){const _0x5f276f={_0x292721:'IieF',_0x5676ca:0x114,_0x4d2e41:'P4gT',_0x17a094:0x144,_0x216cd6:0xdf

dist/cli/mcp-config.js#virtual:normalized:round1View file

1"use strict";const _0x53f5c4=_0x4fc8,_0x10a82f=_0x3800;(function(_0x58238b,_0x59100d){const _0x4cd27f={_0x1de168:"(YB6",_0x18a78e:0x19b,_0x137075:0x17f,_0x2e84bf:0x22a,_0x3335cb:"k...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/mcp-config.js#virtual:normalized:round1View on unpkg · L1

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 40161 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg