registry / AI-agent capability abuse / bigpowers / 2.88.7

bigpowers@2.88.7

73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is a user-invoked agent-skills installer, not an npm install-time hijack: there are no lifecycle scripts, and setup asks which tools to change. Scanner hits on the git-guard hook and localhost dashboard are product files, not a hidden payload or theft chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The user runs bigpowers setup, bigpowers-setup, or the optional bash scripts/install.sh path.

Impact

Selected agents may load package-authored skills, rules, and git-guard hooks from home-directory config paths.

Mechanism

User-consented symlink and hook install into AI-agent config directories

AI rationale

Evidence

package.jsonbin/setup.jsbin/bigpowers.jsscripts/lib/install-helpers.jsscripts/lib/install-targets-a.sh.gemini/extensions/bigpowers/hooks/before-tool-git-guard.sh~/.claude/skills~/.claude/hooks~/.claude/settings.json~/.gemini/config/plugins/bigpowers~/.gemini/hooks~/.gemini/settings.json~/.cursor/rules~/.codex/AGENTS.md~/.copilot/skills

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The setup CLI and bigpowers-setup binary can symlink skills, rules, and hooks into many AI-agent home directories after the user picks tools and confirms.
Gemini setup also links the first-party .gemini/extensions/bigpowers tree and hook scripts into ~/.gemini.
The CLI notes that skipping npm lifecycle scripts bypasses the allow-scripts gate, then still requires a separate setup command.
The optional update command can run npm install -g bigpowers@latest on a global install.
A separate bash installer can merge hook entries into ~/.claude/settings.json and ~/.gemini/settings.json.

Evidence against

package.json has no preinstall, install, or postinstall scripts.
index.js only exports the package name and version, with no import-time work.
Setup is interactive, asks which tools to install, and requires a confirm step.
The installer refuses to replace files that are not already package-managed symlinks.
The dashboard server defaults to 127.0.0.1, and no credential harvest or webhook exfil was found.
The flagged git-guard file is a short shell wrapper, not a hidden binary payload.

Source & flagged code

10 flagged

bin/bigpowers.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

2// story: e38s08

3// bigpowers CLI — detects install state, runs setup on demand.

4// No npm lifecycle scripts needed → bypasses npm v10+ allow-scripts gate.

6const { execSync } = require('child_process');

7const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L5

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bigpowers.jsView on unpkg · L5

8const os = require('os');

9const path = require('path');

11const ROOT = path.dirname(path.dirname(__filename));

12const SKILLS_MARKER = path.join(os.homedir(), '.claude', 'skills', 'survey-context');

13const pkg = require(path.join(ROOT, 'package.json'));

15function isInstalled() {

16 try {

17 return fs.lstatSync(SKILLS_MARKER).isSymbolicLink();

18 } catch {

19 return false;

20 }

21}

23function run(cmd, cwd = ROOT) {

24 try {

25 execSync(cmd, { cwd, stdio: 'inherit' });

26 } catch (e) {

27 console.error(`\n❌ Failed: ${cmd}`);

28 process.exit(1);

29 }

30}

32// True when this copy runs from the global npm install (not a git clone or npx temp dir).

33function isGlobalInstall() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bigpowers.jsView on unpkg · L24

34 try {

35 const globalRoot = execSync('npm root -g', { encoding: 'utf8' }).trim();

36 return globalRoot && ROOT.startsWith(globalRoot);

37 } catch {

38 return false;

39 }

40}

42// `bigpowers update` used to only re-sync the already-installed files, so it never fetched

43// a newer release. When we're the global install, pull the latest from npm first; the reinstall

44// overwrites ROOT in place, so the setup.js required afterwards is the freshly installed one.

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/bigpowers.jsView on unpkg

skills/visual-dashboard/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

scripts/lib/install-helpers.jsView file

•path = scripts/lib/install-helpers.js kind = trigger_reachable_excluded_payload sizeBytes = 29742 triggerReachableSource = scripts/lib/install-helpers.js excludedPayload = .[redacted]-tool-git-guard.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

scripts/lib/install-helpers.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. in(rendereddir, f), path.join(targetdir, f)); } } } { const agentssrc = path.join(reporoot, 'agents.md'); const agentsdst = path.join(homedir, '.kilocode', 'agents.md'); fs.mkdirsync(path.dirname(agentsdst), { recursive: true }); if (fs.existssync(agentssrc)) fs.copyfilesync(agentssrc, agentsdst); } break; case 'trae': linkrenderedskills(path.join(reporoot, '.trae/skills'), path.join(homedir, '.trae', 'skills')); { const agentssrc = path.join(reporoot, 'agents.md'); const agentsdst = path.join(homedir, '.trae', 'agents.md'); fs.mkdirsync(path.dirname

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/lib/install-helpers.jsView on unpkg

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView file

•path = .[redacted]-tool-git-guard.sh kind = payload_in_excluded_dir sizeBytes = 669 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView on unpkg

•path = .[redacted]-tool-git-guard.sh kind = build_helper sizeBytes = 669 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView on unpkg

Source & flagged code

10 flagged · loading source

bin/bigpowers.jsView file

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L5

24try { L25: execSync(cmd, { cwd, stdio: 'inherit' }); L26: } catch (e) { ... L31: L32: // True when this copy runs from the global npm install (not a git clone or npx temp dir). L33: function isGlobalInstall() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bigpowers.jsView on unpkg · L24

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/bigpowers.jsView on unpkg

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

Findings

1 Critical7 High5 Medium4 Low

CriticalTrigger Reachable Excluded Directory Payloadscripts/lib/install-helpers.js

HighChild Processbin/bigpowers.js

HighShell

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/lib/install-helpers.js

HighRuntime Package Installbin/bigpowers.js

HighPayload In Excluded Dir.gemini/extensions/bigpowers/hooks/before-tool-git-guard.sh

HighSemantic Analysis Limitedbin/bigpowers.js

HighKnown Malware Source Similarityskills/visual-dashboard/scripts/server.cjs

MediumDynamic Requirebin/bigpowers.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.gemini/extensions/bigpowers/hooks/before-tool-git-guard.sh

Affected versions and remediation

This report applies to bigpowers@2.88.7.

See all versions of bigpowers for other recorded verdicts.

Review the evidence and your use of bigpowers@2.88.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 02:02:44.137Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

bigpowers@2.88.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code