bmad-speckit-sdd-flow@2.1.11: AI-agent control-surface risk

Loading npm security reports…

Source & flagged code

11 flagged

Lines 1-31json

2 "name": "bmad-speckit-sdd-flow",

3 "version": "2.1.11",

4 "description": "Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit",

5 "scripts": {

6 "build": "npm run build:scoring && npm run build:runtime-context && npm run build:runtime-emit && npm run build:ralph-method && npm run build:main-agent-dist",

7 "lint": "eslint . --ext .ts,.js",

8 "lint:fix": "eslint . --ext .ts,.js --fix",

9 "format": "prettier --write \"packages/**/*.ts\" \"tests/**/*.ts\" \"vitest.config.ts\"",

10 "format:check": "prettier --check \"packages/**/*.ts\" \"tests/**/*.ts\" \"vitest.config.ts\"",

11 "postinstall": "node scripts/init-to-root.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "init": "node scripts/init-to-root.js",

13 "init:claude": "node scripts/init-to-root.js --agent claude-code",

14 "init:cursor": "node scripts/init-to-root.js --agent cursor",

15 "init:codex": "node scripts/init-to-root.js --agent codex",

16 "setup": "pwsh scripts/setup.ps1",

17 "setup:sh": "bash scripts/setup.sh",

18 "setup:full": "pwsh scripts/setup.ps1 -Full",

19 "setup:full:sh": "bash scripts/setup.sh -Full",

20 "test": "npm run test:speckit-mirror-sync && node tools/run-root-tests.cjs",

21 "resolve-active-requirement": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent resolve-active-requirement",

22 "main-agent-orchestration": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration",

23 "main-agent:confirm-scope": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration --action confirm-scope",

24 "main-agent:run-loop": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration --action run-loop",

25 "main-agent:release-gate": "npm run test:governance-fixtures && node packages/bmad-speckit/bin/bmad-speckit.js main-agent release-gate",

26 "main-agent:release-gate:ci": "node packages/bmad-speckit/dist/main-agent/source-authority/scripts/run-ci-release-gate-fixture.js",

27 "main-agent:quality-gate": "npm run test:governance-fixtures && node packages/bmad-speckit/bin/bmad-speckit.js main-agent quality-gate",

28 "main-agent:architecture-drift-check": "node packages/bmad-speckit/bin/bmad-speckit.js architecture-drift-check",

29 "main-agent:soak-contract": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent soak-runner --contract-8h",

30 "main-agent:long-run-soak": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent soak-runner",

31 "test:main-agent-long-run-soak": "npx vitest run --config vitest.long-run.config.ts",

bin/bmad-speckit.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

3/* eslint-disable @typescript-eslint/no-require-imports -- CommonJS wrapper for published root bin */

5const path = require('node:path');

6const fs = require

scripts/init-to-root.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Init-to-root: 灏?_bmad銆乢bmad-output 閮ㄧ讲鍒伴」鐩牴锛屽啀鎸?agent 浠?_bmad/ 鍚屾鍒拌繍琛屾椂鐩綍銆? *

4 * 婧愯矾寰勭害瀹氾細_bmad/ 鏄敮涓€鍐呭婧愩€? * - 鍏变韩 commands: _bmad/commands/

5 * - 鍏变韩 i18n: _bmad/i18n/

6 * - Cursor rules/skills: _bmad/cursor/

7 * - Claude agents/skills/hooks/rules: _bmad/claude/

8 *

9 * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cursor/hooks** 涓?鎴?**.claude/hooks**锛堜笌 hook 鑴氭湰鍚岀洰褰曪紝涓嶅湪椤圭洰鏍瑰垱寤?scripts/锛夛紱legacy worker/dispatch hook-local bundle 涓嶅啀灞炰簬姝ｅ紡瀹夎 contract銆? * `--agent cursor`锛歚syncCursorRuntimePolicyHooks` 鍏堝皢 `_bmad/runtime/hooks` 涓?4 涓叡浜?JS 澶嶅埗鍒?`.cursor/hooks`锛屽啀瑕嗙洊 `emit-runtime-policy-cli.cjs`銆乣runtime-policy-inject.cjs`锛堣杽澹筹紝`./runtime-policy-inject-core` 浼樺厛锛夈€? * `--agent claude-code`锛歚syncClaudeRuntimePolicyHooks` 鍚屾牱灏嗕笂杩?4 ...

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView file

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

_bmad/runtime/hooks/runtime-policy-inject-core.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.9 matchedPath = _bmad/runtime/hooks/runtime-policy-inject-core.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/runtime/hooks/runtime-policy-inject-core.cjsView on unpkg

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.9 matchedPath = tests/acceptance/runtime-dashboard-lifecycle-cli.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView on unpkg

tests/acceptance/runtime-dashboard-stable-launcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.9 matchedPath = tests/acceptance/runtime-dashboard-stable-launcher.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/runtime-dashboard-stable-launcher.test.tsView on unpkg

_bmad/claude/hooks/worktree-create-sibling.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.9 matchedPath = _bmad/claude/hooks/worktree-create-sibling.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/claude/hooks/worktree-create-sibling.cjsView on unpkg

_bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.9 matchedPath = _bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/init-to-root.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/bmad-speckit.jsView file

4L5: const path = require('node:path'); L6: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bmad-speckit.jsView on unpkg · L4

scripts/init-to-root.jsView file

8* L9: * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cur... L10: * CLI 鍙傛暟锛歔targetDir], --full, --agent cursor|claude-code|codex, --no-package-json, --with-package-json, --with-mcp ... L156: const cursorDir = path.join(targetDir, '.cursor'); L157: fs.mkdirSync(cursorDir, { recursive: true }); L158: const hooksJsonPath = path.join(cursorDir, 'hooks.json'); ... L176: }; L177: fs.writeFileSync(hooksJsonPath, `${JSON.stringify(hooksJson, null, 2)}\n`, 'utf8'); L178: } ... L187: { src: path.join(bmadRoot, 'speckit', 'commands'), dest: '.cursor/commands' }, L188: { src: path.join(bmadRoot, 'cursor', 'rules'), dest: '.cursor/rules' }, L189: { src: path.join(bmadRoo

bmad-speckit-sdd-flow@2.1.11: AI-agent control-surface risk | LPM Firewall