Loading npm security reports…

bmad-speckit-sdd-flow@2.1.9: AI-agent policy block | LPM Firewall

registry / bmad-speckit-sdd-flow / 2.1.9

bmad-speckit-sdd-flow@2.1.9

Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package mutates AI-agent control surfaces during npm postinstall. Default install copies package-supplied hooks, skills, rules, agents, and runtime config into the consumer project without an explicit init command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install with lifecycle scripts enabled

Impact

Consumer AI tools may execute package-supplied hook scripts on session/tool/subagent events and receive package-supplied agent instructions.

Mechanism

unconsented lifecycle AI-agent hook/control-surface deployment

Policy narrative

On installation, npm runs scripts/init-to-root.js. With no arguments it selects the cursor profile, targets the consumer root via INIT_CWD/process.cwd, copies _bmad content, writes .cursor/hooks.json, and deploys hook scripts plus agent/skill/rule files. Those hooks are configured to run during AI session, tool, and subagent events, creating an unconsented AI-agent control-surface mutation despite no observed credential exfiltration.

Rationale

Static inspection confirms install-time mutation of Cursor/Claude/Codex agent control files and hook execution surfaces, which is not a normal passive library install behavior. The behavior is disclosed in docs but still occurs by default on lifecycle-enabled npm install, so this meets the firewall policy for unconsented lifecycle AI-agent control-surface mutation. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/init-to-root.jsscripts/bmad-speckit-cli.js_bmad/claude/settings.json_bmad/cursor/hooks/runtime-policy-inject.cjs

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/init-to-root.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

_bmad/cursor/hooks/subagent-result-summary.cjsView file

5const path = require('node:path'); L6: const { spawnSync } = require('node:child_process'); L7:

High

Child Process

Package source references child process execution.

_bmad/cursor/hooks/subagent-result-summary.cjsView on unpkg · L5

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView file

17process.platform === 'win32' L18: ? { file: 'cmd.exe', args: ['/c', cmd] } L19: : { file: 'bash', args: ['-lc', cmd] };

High

Shell

Package source references shell execution.

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView on unpkg · L17

bin/bmad-speckit.jsView file

4L5: const path = require('node:path'); L6: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bmad-speckit.jsView on unpkg · L4

scripts/init-to-root.jsView file

1Install-time AI-agent control hijack evidence: L8: * L9: * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cur... L10: * CLI 鍙傛暟锛歔targetDir], --full, --agent cursor|claude-code|codex, --no-package-json, --with-package-json, --with-mcp ... L96: const cursorDir = path.join(targetDir, '.cursor'); L97: fs.mkdirSync(cursorDir, { recursive: true }); L98: const hooksJsonPath = path.join(cursorDir, 'hooks.json'); ... L116: }; L117: fs.writeFileSync(hooksJsonPath, `${JSON.stringify(hooksJson, null, 2)}\n`, 'utf8'); L118: } ... L155: if (fs.existsSync(crSrc)) { L156: fs.mkdirSync(path.dirname(crDest), { recursive: true }); L157: copyFileWithRetry(crSrc, crDest); Payload evid

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/init-to-root.jsView on unpkg · L1

1299pkg.scripts = pkg.scripts || {}; L1300: if (!pkg.scripts.check) pkg.scripts.check = 'npx bmad-speckit check'; L1301: if (!pkg.scripts.speckit) pkg.scripts.speckit = 'npx bmad-speckit'; ... L1303: console.log('Added bmad-speckit to devDependencies'); L1304: const { execSync } = require('node:child_process'); L1305: try {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/init-to-root.jsView on unpkg · L1299

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView file

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•path = _bmad/skills/requirements-contract-[redacted].min.js kind = oversized_source_file sizeBytes = 2754895 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

_bmad/tea/workflows/testarch/automate/steps-c/step-03c-aggregate.mdView file

168patternName = generic_password severity = medium line = 168 matchedText = data: { ...' },

Medium

Secret Pattern

Hardcoded password in _bmad/tea/workflows/testarch/automate/steps-c/step-03c-aggregate.md

_bmad/tea/workflows/testarch/automate/steps-c/step-03c-aggregate.mdView on unpkg · L168

_bmad/tea/workflows/testarch/atdd/steps-c/step-04c-aggregate.mdView file

173patternName = generic_password severity = medium line = 173 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in _bmad/tea/workflows/testarch/atdd/steps-c/step-04c-aggregate.md

_bmad/tea/workflows/testarch/atdd/steps-c/step-04c-aggregate.mdView on unpkg · L173

_bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in _bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.md

_bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.mdView on unpkg · L76

95patternName = generic_password severity = medium line = 95 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in _bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.md

_bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.mdView on unpkg · L95

_bmad/tea/testarch/knowledge/data-factories.mdView file

317patternName = generic_password severity = medium line = 317 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in _bmad/tea/testarch/knowledge/data-factories.md

_bmad/tea/testarch/knowledge/data-factories.mdView on unpkg · L317

Source & flagged code

14 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "bmad-speckit-sdd-flow",

3 "version": "2.1.9",

4 "description": "Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit",

5 "scripts": {

6 "build": "npm run build:scoring && npm run build:runtime-context && npm run build:runtime-emit && npm run build:ralph-method && npm run build:main-agent-dist",

7 "lint": "eslint . --ext .ts,.js",

8 "lint:fix": "eslint . --ext .ts,.js --fix",

9 "format": "prettier --write \"packages/**/*.ts\" \"tests/**/*.ts\" \"vitest.config.ts\"",

10 "format:check": "prettier --check \"packages/**/*.ts\" \"tests/**/*.ts\" \"vitest.config.ts\"",

11 "postinstall": "node scripts/init-to-root.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "init": "node scripts/init-to-root.js",

13 "init:claude": "node scripts/init-to-root.js --agent claude-code",

14 "init:cursor": "node scripts/init-to-root.js --agent cursor",

15 "init:codex": "node scripts/init-to-root.js --agent codex",

16 "setup": "pwsh scripts/setup.ps1",

17 "setup:sh": "bash scripts/setup.sh",

18 "setup:full": "pwsh scripts/setup.ps1 -Full",

19 "setup:full:sh": "bash scripts/setup.sh -Full",

20 "test": "npm run test:speckit-mirror-sync && npm run test:governance-fixtures && npm run test:vitest:default && npm run test:bmad-speckit",

21 "resolve-active-requirement": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent resolve-active-requirement",

22 "main-agent-orchestration": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration",

23 "main-agent:confirm-scope": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration --action confirm-scope",

24 "main-agent:run-loop": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent-orchestration --action run-loop",

25 "main-agent:release-gate": "npm run test:governance-fixtures && node packages/bmad-speckit/bin/bmad-speckit.js main-agent release-gate",

26 "main-agent:release-gate:ci": "node packages/bmad-speckit/dist/main-agent/source-authority/scripts/run-ci-release-gate-fixture.js",

27 "main-agent:quality-gate": "npm run test:governance-fixtures && node packages/bmad-speckit/bin/bmad-speckit.js main-agent quality-gate",

28 "main-agent:architecture-drift-check": "node packages/bmad-speckit/bin/bmad-speckit.js architecture-drift-check",

29 "main-agent:soak-contract": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent soak-runner --contract-8h",

30 "main-agent:long-run-soak": "node packages/bmad-speckit/bin/bmad-speckit.js main-agent soak-runner",

31 "test:main-agent-long-run-soak": "npx vitest run --config vitest.long-run.config.ts",

_bmad/cursor/hooks/subagent-result-summary.cjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2'use strict';

3

4const fs = require('node:fs');

5const path = require('node:path'

tests/acceptance/runtime-dashboard-lifecycle-cli.test.tsView file

Lines 1-37typescript

1import { afterEach, describe, expect, it } from 'vitest';

2import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';

3import { tmpdir } from 'node:os';

4import { join } from

bin/bmad-speckit.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2'use strict';

3/* eslint-disable @typescript-eslint/no-require-imports -- CommonJS wrapper for published root bin */

4

5const path = require('node:path');

6const fs = require

scripts/init-to-root.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2/**

3 * Init-to-root: 灏?_bmad銆乢bmad-output 閮ㄧ讲鍒伴」鐩牴锛屽啀鎸?agent 浠?_bmad/ 鍚屾鍒拌繍琛屾椂鐩綍銆? *

4 * 婧愯矾寰勭害瀹氾細_bmad/ 鏄敮涓€鍐呭婧愩€? * - 鍏变韩 commands: _bmad/commands/

5 * - 鍏变韩 i18n: _bmad/i18n/

6 * - Cursor rules/skills: _bmad/cursor/

7 * - Claude agents/skills/hooks/rules: _bmad/claude/

8 *

9 * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cursor/hooks** 涓?鎴?**.claude/hooks**锛堜笌 hook 鑴氭湰鍚岀洰褰曪紝涓嶅湪椤圭洰鏍瑰垱寤?scripts/锛夛紱legacy worker/dispatch hook-local bundle 涓嶅啀灞炰簬姝ｅ紡瀹夎 contract銆? * `--agent cursor`锛歚syncCursorRuntimePolicyHooks` 鍏堝皢 `_bmad/runtime/hooks` 涓?4 涓叡浜?JS 澶嶅埗鍒?`.cursor/hooks`锛屽啀瑕嗙洊 `emit-runtime-policy-cli.cjs`銆乣runtime-policy-inject.cjs`锛堣杽澹筹紝`./runtime-policy-inject-core` 浼樺厛锛夈€? * `--agent claude-code`锛歚syncClaudeRuntimePolicyHooks` 鍚屾牱灏嗕笂杩?4 ...

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView file

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•path = _bmad/skills/requirements-contract-[redacted].min.js kind = oversized_source_file sizeBytes = 2754895 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

_bmad/tea/workflows/testarch/automate/steps-c/step-03c-aggregate.mdView file

Lines 148-188markdown

148**A) Authentication Fixtures** (`tests/fixtures/auth.ts`):

149

150```typescript

151import { test as base } from '@playwright/test';

152

153export const test

_bmad/tea/workflows/testarch/atdd/steps-c/step-04c-aggregate.mdView file

Lines 153-193markdown

153```javascript

154const allFixtureNeeds = [...apiTestsOutput.fixture_needs, ...e2eTestsOutput.fixture_needs];

155

156// Remove duplicates

157const uniqueFixtures = [...new

_bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.mdView file

76patternName = generic_password severity = medium line = 76 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in _bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.md

_bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.mdView on unpkg · L76

95patternName = generic_password severity = medium line = 95 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in _bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.md

_bmad/tea/workflows/testarch/atdd/steps-c/step-04a-subprocess-api-failing.mdView on unpkg · L95

_bmad/tea/testarch/knowledge/data-factories.mdView file

317patternName = generic_password severity = medium line = 317 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in _bmad/tea/testarch/knowledge/data-factories.md

_bmad/tea/testarch/knowledge/data-factories.mdView on unpkg · L317