Loading npm security reports…

basinfy@1.1.1: AI-agent control-surface risk | LPM Firewall

registry / basinfy / 1.1.1

basinfy@1.1.1

Repository indexer for coding agents: import-graph map, hybrid basins, BM25/embedding briefings.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs code that detects the consumer project and silently registers MCP configuration for one or more agents. The same hook also mutates installed dependencies and can run a dependency installer.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of the package as a project dependency.

Impact

Adds a package-controlled MCP entry to detected AI-agent configuration without an explicit setup command; opaque configuration code prevents reliable audit of its exact writes.

Mechanism

Automatic MCP configuration and dependency mutation from postinstall.

Policy narrative

On installation, the manifest runs scripts/postinstall.js. For a detected consumer project, it loads an obfuscated MCP configuration module, finds agent identifiers, and calls installMcpConfig silently. This changes an AI-agent control surface without requiring the user to run a setup command. The hook also deletes and recreates installed dependency directories, patches a dependency source file, and may execute onnxruntime-node's installer with inherited environment variables.

AI rationale

This is an unconsented postinstall mutation of a consumer AI-agent control surface, compounded by opaque configuration code and unrelated dependency rewrites. Opt-out variables and the global-install guard do not make the automatic project-install behavior consented.

Evidence

package.jsonscripts/postinstall.jsbin/native-resolve.jsdist/cli/mcp-config.jsnode_modules/sharp/node_modules/onnxruntime-web/node_modules/@xenova/transformers/src/utils/tensor.js

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/native-resolve.jsView file

13L14: const fs = require('fs'); L15: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/native-resolve.jsView on unpkg · L13

dist/core/locker.jsView file

1'use strict';const _0x45543d=_0x27ac,_0x29fddd=_0x1cae;(function(_0x376783,_0x280670){const _0x4b108d={_0x3d72ca:0x1eb,_0x388e78:'hX4&',_0x37474b:'eP3U',_0xbb2667:0x232,_0x22d7c8:0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core/locker.jsView on unpkg · L1

dist/cli/mcp-config.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: 'use strict';const _0x46bb13=_0x1bbf,_0x186648=_0xcc67;(function(_0xb410dd,_0x17ea71){const _0xd8dc98={_0x28bb16:0x289,_0x38d6d5:'^]nZ',_0x29f210:0x1e2,_0x3ef863:'#$KS',_0x413cd3:'... Write operation from scripts/postinstall.js: L68: fs.rmSync(pkgDir, { recursive: true, force: true }); L69: fs.mkdirSync(pkgDir, { recursive: true }); L70: fs.writeFileSync( L71: path.join(pkgDir, 'package.json'), ... L73: ); L74: fs.writeFileSync(indexPath, 'module.exports = {};\n'); L75: } ... L106: } else { L107: fs.writeFileSync(tensorJsPath, tensorContent, 'utf8'); L108: } Foreign user/project scope from scripts/postinstall.js: L68: fs.rmSync(pkgDir, { recursive: true, force: true }); L69: fs.mkdirSync(pkgDir, { recursive: true })

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/mcp-config.jsView on unpkg · L1

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 154916 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg

dist/api/basinfy-facade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/api/basinfy-facade.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 61-101json

61 "benchmark:arena": "ts-node --transpile-only scripts/arena-retrieval.ts",

62 "benchmark:neutral": "ts-node --transpile-only scripts/neutral-retrieval-bench.ts",

63 "benchmark:fresh": "ts-node --transpile-only scripts/neutral-retrieval-bench.ts --dataset scripts/fresh-dataset.json --out-stem fresh-retrieval-bench",

64 "benchmark:clean-arena": "ts-node --transpile-only scripts/clean-arena-bench.ts",

65 "benchmark:swe-retrieval": "ts-node --transpile-only scripts/swe-retrieval-bench.ts",

66 "benchmark:swe-retrieval:curate": "python scripts/curate-swe-retrieval-dataset.py",

67 "benchmark:swe-retrieval:checkout": "python scripts/swe_checkout_worker.py checkout-batch --dataset scripts/swe-retrieval-dataset.json",

68 "benchmark:swe-retrieval:install-aider": "python -m pip install -r scripts/requirements-swe-benchmark.txt",

69 "benchmark:hub-fix": "ts-node --transpile-only scripts/hub-fix-regression.ts",

70 "benchmark:rank-trace": "ts-node --transpile-only scripts/rank-stage-trace.ts",

71 "lab:snapshot": "ts-node --transpile-only scripts/config-lab.ts snapshot",

72 "lab:analyze": "ts-node --transpile-only scripts/config-lab.ts analyze",

73 "lab:search": "ts-node --transpile-only scripts/config-lab.ts search",

74 "lab:promote": "ts-node --transpile-only scripts/config-lab.ts promote",

75 "benchmark:recall-canvas": "ts-node scripts/generate-recall-canvas-data.ts",

76 "benchmark:calibrate": "ts-node scripts/calibrate-es.ts --quick",

77 "benchmark:calibrate:es": "ts-node scripts/calibrate-es.ts",

78 "benchmark:train:full": "ts-node scripts/train-calibrate-full.ts",

79 "evolve:online": "ts-node scripts/evolve-online.ts",

80 "prepublishOnly": "npm run build:release && npm run verify:pack && npm run pack:audit",

81 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L81

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L81

82 "dev": "ts-node-dev --respawn --transpile-only src/cli/index.ts",

83 "sbom": "node scripts/generate-sbom.js",

84 "sbom:xml": "node scripts/generate-sbom.js --format xml"

85 },

86 "keywords": [

87 "ai",

88 "agents",

89 "code-indexing",

90 "knowledge-graph",

91 "claude",

92 "copilot",

93 "cursor",

94 "context-compression",

95 "token-savings"

96 ],

97 "author": "Alex Martins",

98 "license": "SEE LICENSE IN LICENSE",

99 "repository": {

100 "type": "git",

101 "url": "https://basinfy.com"

bin/native-resolve.jsView file

Lines 1-33javascript

1/**

2 * Native-module resolution for global npm installs.

3 *

4 * @huggingface/transformers nests onnxruntime-node; that copy often has

5 * package.json but no dist/index.js (skipped scripts / incomplete native install).

6 * The hoisted copy can also be missing bin/napi-v6/platform/arch/onnxruntime_binding.node

7 * when `onnxruntime-node` floated past 1.19.2 or install scripts were skipped.

8 *

9 * Redirect onnxruntime-node (and its .node binding) only to a complete copy.

10 * Sharp and onnxruntime-web stay stubbed (unused by the CLI).

dist/core/locker.jsView file

Lines 1-1javascript

1'use strict';const _0x45543d=_0x27ac,_0x29fddd=_0x1cae;(function(_0x376783,_0x280670){const _0x4b108d={_0x3d72ca:0x1eb,_0x388e78:'hX4&',_0x37474b:'eP3U',_0xbb2667:0x232,_0x22d7c8:

dist/cli/mcp-config.jsView file

Lines 1-1javascript

1'use strict';const _0x46bb13=_0x1bbf,_0x186648=_0xcc67;(function(_0xb410dd,_0x17ea71){const _0xd8dc98={_0x28bb16:0x289,_0x38d6d5:'^]nZ',_0x29f210:0x1e2,_0x3ef863:'#$KS',_0x413cd3:

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 154916 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg

dist/api/basinfy-facade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/api/basinfy-facade.js#virtual:normalized:round1View on unpkg