Loading npm security reports…

bmad-speckit-sdd-flow@3.0.0: AI-agent control-surface risk | LPM Firewall

registry / bmad-speckit-sdd-flow / 3.0.0

bmad-speckit-sdd-flow@3.0.0

Agent governance and AI-TDD control plane for requirement-contract-driven Main Agent orchestration, built on BMAD + Spec-Kit

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install runs a postinstall script that copies this package's agent tree into the consumer project and registers Cursor hook commands. The default agent is cursor, so installing the package rewrites the host editor's hook control surface without a separate setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall of bmad-speckit-sdd-flow, which executes scripts/init-to-root.js.

Impact

A normal install persistently hooks the consumer Cursor agent so later sessions and tool calls execute package-supplied hook scripts.

Mechanism

The script resolves the consumer root from INIT_CWD, defaults the agent to cursor, copies commands, rules, skills, and hook scripts into .cursor, and writes .cursor/hooks.json so Cursor runs those scripts on session and tool events.

Policy narrative

On npm install, postinstall launches scripts/init-to-root.js. With no --agent flag it selects cursor and treats INIT_CWD as the project to modify. It copies the package _bmad tree into that project and syncs commands, rules, skills, agents, and hook scripts into .cursor. It then writes .cursor/hooks.json so Cursor starts node hook scripts on sessionStart, preToolUse, subagentStart, subagentStop, and postToolUse. That is an install-time takeover of the editor agent control surface. MCP files and a nested npm install stay behind explicit flags.

AI rationale

Postinstall unconditionally deploys Cursor hooks, rules, skills, and commands into the consumer project, which is an unconsented mutation of a foreign agent control surface. Optional MCP and package.json flags do not gate that default hook install.

Evidence

package.jsonscripts/init-to-root.js.cursor/hooks.json

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/init-to-root.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

_bmad/cursor/hooks/subagent-result-summary.cjsView file

5const path = require('node:path'); L6: const { spawnSync } = require('node:child_process'); L7:

High

Child Process

Package source references child process execution.

_bmad/cursor/hooks/subagent-result-summary.cjsView on unpkg · L5

_bmad/skills/governed-feature-delivery/scripts/run-phase.mjsView file

864function verifyCommand(repo, command) { L865: const result = spawnSync(command, { cwd: repo, shell: true, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024 }); L866: return { status: result.status === 0 && !result.error ? 'pass' : 'fail', exitCode: result.status, signal: result.signal, output: `${result.stdout ?? ''}${result.stderr ?? ''}`, err...

High

Shell

Package source references shell execution.

_bmad/skills/governed-feature-delivery/scripts/run-phase.mjsView on unpkg · L864

node_modules/ajv/dist/compile/jtd/serialize.jsView file

49sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${serializeFuncCode}`; L50: const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode); L51: const serialize = makeSerialize(this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

node_modules/ajv/dist/compile/jtd/serialize.jsView on unpkg · L49

bin/bmad-speckit.jsView file

4L5: const path = require('node:path'); L6: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bmad-speckit.jsView on unpkg · L4

node_modules/bmad-speckit/dist/services/install-surface-manifest.jsView file

43try { L44: return JSON.parse(fs.readFileSync(filePath, 'utf8')); L45: } ... L343: logicalPath: '_bmad', L344: kind: 'project_private_dir', L345: ownerAgents: normalizedTools, ... L544: const rest = raw.slice(1).replace(/^[/\\]/, '') || ''; L545: return rest ? path.join(require('os').homedir(), rest) : require('os').homedir(); L546: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

node_modules/bmad-speckit/dist/services/install-surface-manifest.jsView on unpkg · L43

scripts/init-to-root.jsView file

8* L9: * 鐢ㄩ€旓細閮ㄧ讲 BMAD 鐩綍缁撴瀯銆? * 瀵瑰閮ㄧ洰鏍囩洰褰曪細浠?@bmad-speckit/runtime-emit 灏?emit-runtime-policy.cjs銆乺esolve-for-session.cjs銆乺ender-audit-block.cjs 涓?write-runtime-context.cjs 澶嶅埗鍒?**.cur... L10: * CLI 鍙傛暟锛歔targetDir], --full, --agent cursor|claude-code|codex, --no-package-json, --with-package-json, --with-mcp ... L181: const cursorDir = path.join(targetDir, '.cursor'); L182: fs.mkdirSync(cursorDir, { recursive: true }); L183: const hooksJsonPath = path.join(cursorDir, 'hooks.json'); ... L201: }; L202: fs.writeFileSync(hooksJsonPath, `${JSON.stringify(hooksJson, null, 2)}\n`, 'utf8'); L203: } ... L212: { src: path.join(bmadRoot, 'speckit', 'commands'), dest: '.cursor/commands' }, L213: { src: path.join(bmadRoot, 'cursor', 'rules'), dest: '.cursor/rules' }, L214: { src: path.join(bmadRoo

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/init-to-root.jsView on unpkg · L8

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. totalfiles += copyskilldirsrecursive(path.join(bmadroot, 'core', 'tasks'), path.join(targetdir, '.claude', 'skills'), targetdir); totalfiles += copyskilldirsrecursive(path.join(bmadroot, 'core', 'skills'), path.join(targetdir, '.claude', 'skills'), targetdir); const settingssrc = path.join(bmadroot, 'claude', 'settings.json'); const settingsdest = path.join(targetdir, '.claude', 'settings.json'); if (fs.existssync(settingssrc)) { fs.mkdirsync(path.dirname(settingsdest), { recursive: true }); const bmadsettings = normalizeclaudehookcommand

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

node_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjsView file

15461const executeAuditorScript = deps.executeAuditorScript ?? ((args) => { L15462: (0, import_child_process.execSync)(`npx ts-node ${args.auditorScript} ${args.artifactPath} ${args.iteration}`, { L15463: cwd: args.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

node_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjsView on unpkg · L15461

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjsView on unpkg

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView file

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = payload_in_excluded_dir sizeBytes = 7723 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

•path = _bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py kind = build_helper sizeBytes = 7723 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.pyView on unpkg

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 42

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

node_modules/@bmad-speckit/runtime-emit/dist/emit-runtime-policy.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/@bmad-speckit/runtime-emit/dist/emit-runtime-policy.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@bmad-speckit/runtime-emit/dist/emit-runtime-policy.cjsView on unpkg

node_modules/@bmad-speckit/runtime-emit/dist/resolve-for-session.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/@bmad-speckit/runtime-emit/dist/emit-runtime-policy.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/@bmad-speckit/runtime-emit/dist/resolve-for-session.cjsView on unpkg

node_modules/bmad-speckit/_bmad/runtime/hooks/runtime-policy-inject-core.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/runtime/hooks/runtime-policy-inject-core.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/runtime/hooks/runtime-policy-inject-core.cjsView on unpkg

node_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.jsView on unpkg

node_modules/bmad-speckit/_bmad/claude/hooks/worktree-create-sibling.cjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/claude/hooks/worktree-create-sibling.cjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/claude/hooks/worktree-create-sibling.cjsView on unpkg

node_modules/bmad-speckit/_bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.jsView on unpkg

node_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/close-completed-campaign.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/close-completed-campaign.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/close-completed-campaign.jsView on unpkg

node_modules/bmad-speckit/_bmad/skills/governed-feature-delivery/scripts/tests/run-phase.test.mjsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/skills/governed-feature-delivery/scripts/tests/run-phase.test.mjs matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/skills/governed-feature-delivery/scripts/tests/run-phase.test.mjsView on unpkg

node_modules/bmad-speckit/_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/_bmad/skills/requirements-contract-[redacted].min.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.jsView on unpkg

node_modules/bmad-speckit/dist/commands/provider-smoke.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/dist/commands/provider-smoke.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/dist/commands/provider-smoke.jsView on unpkg

node_modules/bmad-speckit/dist/main-agent/actions/native-goal-invoker.jsView file

•matchType = normalized_sha256 matchedPackage = bmad-speckit-sdd-flow@2.2.1 matchedPath = node_modules/bmad-speckit/dist/main-agent/actions/native-goal-invoker.js matchedIdentity = npm:Ym1hZC1zcGVja2l0LXNkZC1mbG93:2.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

node_modules/bmad-speckit/dist/main-agent/actions/native-goal-invoker.jsView on unpkg

Findings

1 Critical19 High5 Medium8 Low

CriticalAi Agent Control Hijackscripts/init-to-root.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Process_bmad/cursor/hooks/subagent-result-summary.cjs

HighShell_bmad/skills/governed-feature-delivery/scripts/run-phase.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/init-to-root.js

HighRuntime Package Installnode_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjs

HighPayload In Excluded Dir_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py

HighSemantic Analysis Limited_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.js

HighKnown Malware Source Similaritynode_modules/@bmad-speckit/runtime-emit/dist/emit-runtime-policy.cjs

HighKnown Malware Source Similaritynode_modules/@bmad-speckit/runtime-emit/dist/resolve-for-session.cjs

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/runtime/hooks/runtime-policy-inject-core.cjs

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/build-execution-package.js

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/claude/hooks/worktree-create-sibling.cjs

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/skills/goal-execution-contract-generator/scripts/check-docs-review-dependency.js

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/skills/goal-subcontract-execution-package-generator/scripts/close-completed-campaign.js

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/skills/governed-feature-delivery/scripts/tests/run-phase.test.mjs

HighKnown Malware Source Similaritynode_modules/bmad-speckit/_bmad/skills/requirements-contract-authoring/assets/mermaid/mermaid.min.js

HighKnown Malware Source Similaritynode_modules/bmad-speckit/dist/commands/provider-smoke.js

HighKnown Malware Source Similaritynode_modules/bmad-speckit/dist/main-agent/actions/native-goal-invoker.js

HighKnown Malware Source Similaritynode_modules/@bmad-speckit/runtime-emit/dist/run-auditor-host.cjs

MediumDynamic Requirebin/bmad-speckit.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper_bmad/core/skills/bmad-distillator/scripts/tests/test_analyze_sources.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalnode_modules/ajv/dist/compile/jtd/serialize.js

LowWeak Cryptonode_modules/bmad-speckit/dist/services/install-surface-manifest.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings