Loading npm security reports…

bmad-speckit-sdd-flow@2.1.12: AI-agent control-surface risk | LPM Firewall

registry / bmad-speckit-sdd-flow / 2.1.12

bmad-speckit-sdd-flow@2.1.12

Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code targets the consumer project and defaults to the Cursor profile. It creates .cursor/hooks.json and installs commands, rules, skills, agents, and executable hooks that run on Cursor lifecycle events.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during installation into a consumer project

Impact

Unconsented package code becomes configured to run for Cursor sessions and tool events in the consumer project.

Mechanism

Default Cursor AI-agent control-surface mutation and lifecycle-hook installation

Policy narrative

Installing the package invokes scripts/init-to-root.js. With no explicit agent option it selects Cursor, resolves the consumer project via INIT_CWD/cwd, copies package-managed AI assets into .cursor, and writes hooks.json pointing to package-installed hook scripts for session start, pre-tool use, subagent, and post-tool events. This is an unconsented postinstall mutation of a foreign AI-agent control surface.

Rationale

The lifecycle script performs a concrete default postinstall mutation of the consumer’s Cursor configuration and installs automatic hook execution. This meets the firewall block boundary regardless of the absence of observed exfiltration.

Evidence

package.jsonscripts/init-to-root.js_bmad/runtime/hooks/runtime-policy-inject-core.cjs_bmad/**.cursor/hooks.json.cursor/hooks/**.cursor/commands/**.cursor/rules/**

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/init-to-root.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/bmad-speckit.jsView file

4L5: const path = require('node:path'); L6: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bmad-speckit.jsView on unpkg · L4

scripts/init-to-root.jsView file

8* L9: * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cur... L10: * CLI 鍙傛暟锛歔targetDir], --full, --agent cursor|claude-code|codex, --no-package-json, --with-package-json, --with-mcp ... L156: const cursorDir = path.join(targetDir, '.cursor'); L157: fs.mkdirSync(cursorDir, { recursive: true }); L158: const hooksJsonPath = path.join(cursorDir, 'hooks.json'); ... L176: }; L177: fs.writeFileSync(hooksJsonPath, `${JSON.stringify(hooksJson, null, 2)}\n`, 'utf8'); L178: } ... L187: { src: path.join(bmadRoot, 'speckit', 'commands'), dest: '.cursor/commands' }, L188: { src: path.join(bmadRoot, 'cursor', 'rules'), dest: '.cursor/rules' }, L189: { src: path.join(bmadRoo

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/init-to-root.jsView on unpkg · L8

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView file

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

tests/acceptance/requirements-contract-codex-cli-judge-adapter.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = tests/acceptance/requirements-contract-codex-cli-judge-adapter.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/requirements-contract-codex-cli-judge-adapter.test.tsView on unpkg

_bmad/runtime/hooks/runtime-policy-inject-core.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = _bmad/runtime/hooks/runtime-policy-inject-core.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/runtime/hooks/runtime-policy-inject-core.cjsView on unpkg

_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = _bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.jsView on unpkg

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = tests/acceptance/runtime-dashboard-lifecycle-cli.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView on unpkg

tests/acceptance/runtime-dashboard-stable-launcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = tests/acceptance/runtime-dashboard-stable-launcher.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/runtime-dashboard-stable-launcher.test.tsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "bmad-speckit-sdd-flow",

3 "version": "2.1.12",

4 "description": "Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit",

5 "scripts": {

6 "build": "npm run build:scoring && npm run build:runtime-context && npm run build:runtime-emit && npm run build:ralph-method && npm run build:main-agent-dist",

7 "lint": "eslint . --ext .ts,.js",

8 "lint:fix": "eslint . --ext .ts,.js --fix",

9 "format": "prettier --write \"packages/**/*.ts\" \"tests/**/*.ts\" \"vitest.config.ts\"",

10 "format:check": "prettier --check \"packages/**/*.ts\" \"tests/**/*.ts\" \"vitest.config.ts\"",

11 "postinstall": "node scripts/init-to-root.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "init": "node scripts/init-to-root.js",

13 "init:claude": "node scripts/init-to-root.js --agent claude-code",

14 "init:cursor": "node scripts/init-to-root.js --agent cursor",

15 "init:codex": "node scripts/init-to-root.js --agent codex",

16 "setup": "pwsh scripts/setup.ps1",

17 "setup:sh": "bash scripts/setup.sh",

18 "setup:full": "pwsh scripts/setup.ps1 -Full",

19 "setup:full:sh": "bash scripts/setup.sh -Full",

20 "test": "npm run test:speckit-mirror-sync && node tools/run-root-tests.cjs",

21 "resolve-active-requirement": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent resolve-active-requirement",

22 "main-agent-orchestration": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration",

23 "main-agent:confirm-scope": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration --action confirm-scope",

24 "main-agent:run-loop": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration --action run-loop",

25 "main-agent:release-gate": "npm run test:governance-fixtures && node packages/bmad-speckit/bin/bmad-speckit.js main-agent release-gate",

26 "main-agent:release-gate:ci": "node packages/bmad-speckit/dist/main-agent/source-authority/scripts/run-ci-release-gate-fixture.js",

27 "main-agent:quality-gate": "npm run test:governance-fixtures && node packages/bmad-speckit/bin/bmad-speckit.js main-agent quality-gate",

28 "main-agent:architecture-drift-check": "node packages/bmad-speckit/bin/bmad-speckit.js architecture-drift-check",

29 "main-agent:soak-contract": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent soak-runner --contract-8h",

30 "main-agent:long-run-soak": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent soak-runner",

31 "test:main-agent-long-run-soak": "npx vitest run --config vitest.long-run.config.ts",

bin/bmad-speckit.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

3/* eslint-disable @typescript-eslint/no-require-imports -- CommonJS wrapper for published root bin */

4

5const path = require('node:path');

6const fs = require

scripts/init-to-root.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * Init-to-root: 灏?_bmad銆乢bmad-output 閮ㄧ讲鍒伴」鐩牴锛屽啀鎸?agent 浠?_bmad/ 鍚屾鍒拌繍琛屾椂鐩綍銆? *

4 * 婧愯矾寰勭害瀹氾細_bmad/ 鏄敮涓€鍐呭婧愩€? * - 鍏变韩 commands: _bmad/commands/

5 * - 鍏变韩 i18n: _bmad/i18n/

6 * - Cursor rules/skills: _bmad/cursor/

7 * - Claude agents/skills/hooks/rules: _bmad/claude/

8 *

9 * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cursor/hooks** 涓?鎴?**.claude/hooks**锛堜笌 hook 鑴氭湰鍚岀洰褰曪紝涓嶅湪椤圭洰鏍瑰垱寤?scripts/锛夛紱legacy worker/dispatch hook-local bundle 涓嶅啀灞炰簬姝ｅ紡瀹夎 contract銆? * `--agent cursor`锛歚syncCursorRuntimePolicyHooks` 鍏堝皢 `_bmad/runtime/hooks` 涓?4 涓叡浜?JS 澶嶅埗鍒?`.cursor/hooks`锛屽啀瑕嗙洊 `emit-runtime-policy-cli.cjs`銆乣runtime-policy-inject.cjs`锛堣杽澹筹紝`./runtime-policy-inject-core` 浼樺厛锛夈€? * `--agent claude-code`锛歚syncClaudeRuntimePolicyHooks` 鍚屾牱灏嗕笂杩?4 ...

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView file

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

tests/acceptance/requirements-contract-codex-cli-judge-adapter.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = tests/acceptance/requirements-contract-codex-cli-judge-adapter.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/requirements-contract-codex-cli-judge-adapter.test.tsView on unpkg

_bmad/runtime/hooks/runtime-policy-inject-core.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = _bmad/runtime/hooks/runtime-policy-inject-core.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/runtime/hooks/runtime-policy-inject-core.cjsView on unpkg

_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = _bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.jsView on unpkg

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = tests/acceptance/runtime-dashboard-lifecycle-cli.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView on unpkg

tests/acceptance/runtime-dashboard-stable-launcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.1.11 matchedPath = tests/acceptance/runtime-dashboard-stable-launcher.test.ts matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

tests/acceptance/runtime-dashboard-stable-launcher.test.tsView on unpkg