Loading npm security reports…

brainforge-kit: AI-agent control-surface risk | LPM Firewall

registry / brainforge-kit / 0.3.0-beta.5

brainforge-kit@0.3.0-beta.5

Conversational workspaces, agents and workflows for AI assistants.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consumer project's shared AI-agent instructions, hooks, and command permissions. These changes reach Claude and Codex control surfaces without an installation-time consent prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A local npm installation into the project's node_modules when the installer skip conditions are absent.

Impact

Subsequent agent sessions receive package-directed instructions and hooks, while Claude gains permission to execute the package's team-sync command without prompting.

Mechanism

The postinstall hook calls project initialization, which appends instructions, installs skills, merges prompt hooks, and adds command permission rules.

Policy narrative

A normal local npm installation activates postinstall.mjs. It initializes the consumer project without asking for consent, appending instructions to AGENTS.md and CLAUDE.md and installing agent skills. Initialization also merges prompt hooks into Claude and Codex configuration and adds Claude command permissions for team synchronization. The behavior therefore changes broad agent control surfaces automatically during installation.

AI rationale

Inspected source establishes automatic, unconsented postinstall mutation of shared AI-agent instructions and configuration, meeting the blocking policy. Environment skips and preservation safeguards limit scope but do not authorize these changes.

Evidence

package.jsonpostinstall.mjsinit-project.mjsAGENTS.mdCLAUDE.md.agents/skills/brainforge-start/SKILL.md

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

init-project.mjsView file

21Install-time code directly mutates a foreign AI-agent control surface: L21: if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) throw new Error('The target must be an existing project directory.'); L22: for (const rel of ['', '.brainforge', '.brainforge/kit', '.brainforge/workspace', '.brainforge/workspace/kit-backups', '.agents', '.agents/skills', '.agents/skills/brainforge-start... L23: const part = path.join(target, rel); ... L48: else { L49: fs.writeFileSync(file, old.slice(0, begin) + current + old.slice(end + blockEnd.length), 'utf8'); L50: report.updated.push(name); ... L61: const block = instruction.replaceAll('\n', eol); L62: fs.writeFileSync(file, old + (old && !old.endsWith('\n') ? eol : '') + (old ? eol : '') + block, 'utf8'); L63: report.appended.push(name); ...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

init-project.mjsView on unpkg · L21

5import { fileURLToPath } from 'node:url'; L6: import { spawnSync } from 'node:child_process'; L7:

High

Child Process

Package source references child process execution.

init-project.mjsView on unpkg · L5

onboarding/skills/premium-web-design/scripts/site-check.template.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = brainforge-kit@0.3.0-beta.0 matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.0 similarity = 0.619 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

onboarding/skills/premium-web-design/scripts/site-check.template.mjsView on unpkg

10// SITE_DIR=dist SITE_COMMAND='npx vite preview --outDir $SITE_DIR --port $PORT --host 127.0.0.1' node scripts/site-check.mjs L11: // PowerShell, single quotes as well: L12: // $env:SITE_DIR = 'dist'; $env:SITE_COMMAND = 'npm run preview -- --port $PORT --host 127.0.0.1'; node scripts/site-check.mjs

High

Shell

Package source references shell execution.

onboarding/skills/premium-web-design/scripts/site-check.template.mjsView on unpkg · L10

131releases.push(() => new Promise(resolve => { server.close(() => resolve()); server.closeAllConnections(); })); L132: return { origin: `http://127.0.0.1:${server.address().port}` }; L133: } ... L142: const keep = ['PATH', 'Path', 'PATHEXT', 'SystemRoot', 'ComSpec', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'TEMP', 'TMP']; L143: const env = { ...Object.fromEntries(keep.filter(name => process.env[name]).map(name => [name, process.env[name]])), PORT: String(port), HOST: '127.0.0.1', NODE_ENV: 'production' }; L144: const line = command.replaceAll('$PORT', String(port)).replaceAll('$SITE_DIR', `"${root}"`); L145: const child = spawn(line, { shell: true, env, stdio: ['ignore', 'ignore', 'pipe'], detached: process.platform !== 'win32' }); L146: let failure = '';

onboarding/skills/premium-web-design/tests/qa-paths.check.mjsView file

2import assert from 'node:assert/strict'; L3: import { spawnSync } from 'node:child_process'; L4: import { existsSync, readdirSync } from 'node:fs'; ... L173: test('motion cases are unverified in a hidden pane and still fail when visible', async () => { L174: const { exitCodeFor, gateMotion, summarize, HIDDEN_PANE } = await load(); L175: let ran = 0; ... L195: const fakePlaywright = `import { appendFileSync, writeFileSync } from 'node:fs'; L196: const log = line => appendFileSync(process.env.FAKE_CALLS, line + '\\n'); L197: const visible = process.env.FAKE_VISIBLE === '1'; ... L235: assert.match(run.child.stderr, /hidden pane: motion unverified/); L236: const report = JSON.parse(await readFile(path.join(run.output, 'results.json'), 'utf8')); L237: assert.equal(report.complete, false);

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

onboarding/skills/premium-web-design/tests/qa-paths.check.mjsView on unpkg · L2

429assert.ok(literal, 'CONFIG.libraryChunks is a regular expression literal'); L430: const pattern = new Function(`return ${literal}`)(); L431: for (const hit of ['/assets/three.module-a1b2.js', '/assets/gsap-AB12.js', '/assets/ScrollTrigger.min.js', '/_next/static/chunks/framer-motion-9f.js', '/assets/lenis.mjs', '/assets...

Low

Eval

Package source references a known benign dynamic code generation pattern.

onboarding/skills/premium-web-design/tests/qa-paths.check.mjsView on unpkg · L429

runtime/scope-verify.mjsView file

39try { L40: return await import(pathToFileURL(enginePath).href); L41: } finally {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/scope-verify.mjsView on unpkg · L39

agent-kit/hooks/scope-guard.mjsView file

1122if (!tokens.length && targets.length) return { kind: "fsMutation", cmd: "redirect", paths: targets }; L1123: // `npx pkg@ver …` / `bunx …` / `pnpm dlx …` run the package: judge the package. L1124: tokens = unwrapRunner(tokens); ... L1130: L1131: // PowerShell .NET file API ([System.IO.File]::WriteAllText(...)) — a write L1132: // with no cmdlet and no shell operator. Paths hide inside the call: deny.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

agent-kit/hooks/scope-guard.mjsView on unpkg · L1122

•matchType = normalized_sha256 matchedPackage = brainforge-kit@0.3.0-beta.3 matchedPath = agent-kit/hooks/scope-guard.mjs matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-kit/hooks/scope-guard.mjsView on unpkg

runtime/catalog-index.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/catalog-index.mjs#virtual:string-array:round1View on unpkg

runtime/evals/adapters.mjsView file

•matchType = normalized_sha256 matchedPackage = brainforge-kit@0.3.0-beta.3 matchedPath = runtime/evals/adapters.mjs matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/evals/adapters.mjsView on unpkg

runtime/evals/process.mjsView file

•matchType = normalized_sha256 matchedPackage = brainforge-kit@0.3.0-beta.3 matchedPath = runtime/evals/process.mjs matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/evals/process.mjsView on unpkg

runtime/evals/runner.mjsView file

•matchType = normalized_sha256 matchedPackage = brainforge-kit@0.3.0-beta.3 matchedPath = runtime/evals/runner.mjs matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/evals/runner.mjsView on unpkg

runtime/evals/fixtures/outcomes/integration-payment-webhook-en/reference/src/webhook.mjsView file

•matchType = normalized_sha256 matchedPackage = brainforge-kit@0.3.0-beta.3 matchedPath = [redacted]-payment-webhook-en/reference/src/webhook.mjs matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/evals/fixtures/outcomes/integration-payment-webhook-en/reference/src/webhook.mjsView on unpkg

runtime/evals/fixtures/outcomes/integration-payment-webhook-pt-br/reference/src/webhook.mjsView file

•matchType = normalized_sha256 matchedPackage = brainforge-kit@0.3.0-beta.3 matchedPath = [redacted]-payment-webhook-en/reference/src/webhook.mjs matchedIdentity = npm:YnJhaW5mb3JnZS1raXQ:0.3.0-beta.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

runtime/evals/fixtures/outcomes/integration-payment-webhook-pt-br/reference/src/webhook.mjsView on unpkg

Lines 111-151javascript

111async function startStatic(root, rules) {

112 const base = await realpath(root);

113 const server = http.createServer(async (req, res) => {

114 try {

115 const pathname = decodeURIComponent(new URL(req.url, 'http://x').pathname);

116 if (/[\\\0:]/.test(pathname) || pathname.split('/').includes('..')) { res.writeHead(400); return res.end(); }

117 const candidates = [pathname, `${pathname}.html`, path.posix.join(pathname, 'index.html')];

118 let file;

119 for (const candidate of candidates) {

120 const full = path.join(base, candidate);

121 if (path.relative(base, full).startsWith('..')) continue;

122 if (await stat(full).then(s => s.isFile(), () => false)) { file = full; break; }

123 }

124 const headers = Object.assign({}, ...rules.filter(rule => rule.test.test(pathname)).map(rule => rule.headers));

125 if (!file) { res.writeHead(404, headers); return res.end('Not found'); }

126 res.writeHead(200, { 'Content-Type': types[path.extname(file)] || 'application/octet-stream', 'Cache-Control': 'no-store', ...headers });

127 res.end(req.method === 'HEAD' ? undefined : await readFile(file));

128 } catch { res.writeHead(400); res.end(); }

129 });

130 await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });

131 releases.push(() => new Promise(resolve => { server.close(() => resolve()); server.closeAllConnections(); }));

132 return { origin: `http://127.0.0.1:${server.address().port}` };

133}

134

135// Optional: the framework's own preview server (SSR, functions). It gets a scrubbed environment and a free

136// port, and is stopped with its process tree by the PID this script spawned, never by process name.

137async function startCommand(command, root) {

138 const probe = http.createServer();

139 await new Promise(resolve => probe.listen(0, '127.0.0.1', resolve));

140 const port = probe.address().port;

141 await new Promise(resolve => probe.close(resolve));

142 const keep = ['PATH', 'Path', 'PATHEXT', 'SystemRoot', 'ComSpec', 'HOME', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'TEMP', 'TMP'];

143 const env = { ...Object.fromEntries(keep.filter(name => process.env[name]).map(name => [name, process.env[name]])), PORT: String(port), HOST: '127.0.0.1', NODE_ENV: 'production' };

144 const line = command.replaceAll('$PORT', String(port)).replaceAll('$SITE_DIR', `"${root}"`);

145 const child = spawn(line, { shell: true, env, stdio: ['ignore', 'ignore', 'pipe'], detached: process.platform !== 'win32' });

146 let failure = '';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

onboarding/skills/premium-web-design/scripts/site-check.template.mjsView on unpkg · L131

147 let errors = '';

148 child.once('error', error => { failure = error.message; });

149 child.stderr.on('data', chunk => { errors = (errors + chunk).slice(-1500); });

150 const running = () => child.exitCode === null && child.signalCode === null;

151 releases.push(async () => {

Lines 409-449javascript

409 try {

410 assert.equal(defaults.child.status, 3, 'unmatched scene and library cases stay unverified by default');

411 assert.deepEqual([...new Set(defaults.report.results.filter(item => item.status === 'unverified').map(item => item.case))].sort(), ['WebGL context loss', 'libraries blocked']);

412 assert.deepEqual(defaults.leftovers, []);

413 } finally { await cleanUp(defaults); }

414 const configured = await runSiteCheck({ mode: 'full', edit: source => source.replace(/^(\s*)scene: true,/m, '$1scene: false,').replace(/^(\s*)libraryChunks:

415 try {

416 assert.equal(configured.child.status, 0, configured.child.stdout + configured.child.stderr);

417 const skipped = configured.report.results.filter(item => item.status === 'skipped');

418 assert.deepEqual(skipped.map(item => item.case).sort(), ['WebGL context loss', 'libraries blocked']);

419 assert.ok(skipped.every(item => /CONFIG\./.test(item.reason)), 'each skip names the setting that turned it off');

420 assert.equal(configured.report.skipped, 2);

421 assert.equal(configured.report.unverified, 0);

422 assert.ok(configured.log.includes('browser.close'));

423 } finally { await cleanUp(configured); }

424});

425

426test('the library pattern matches whole name parts of a request path', async () => {

427 const source = await readFile(template, 'utf8');

428 const literal = /^\s*libraryChunks: (\/.*\/i),/m.exec(source)?.[1];

429 assert.ok(literal, 'CONFIG.libraryChunks is a regular expression literal');

430 const pattern = new Function(`return ${literal}`)();

431 for (const hit of ['/assets/three.module-a1b2.js', '/assets/gsap-AB12.js', '/assets/ScrollTrigger.min.js', '/_next/static/chunks/framer-motion-9f.js', '/assets/lenis.mjs', '/assets/vendor-ogl.js']) assert.match(hit, pattern, hit);

Low

Eval

Package source references a known benign dynamic code generation pattern.

onboarding/skills/premium-web-design/tests/qa-paths.check.mjsView on unpkg · L429

432 for (const miss of ['/assets/promotion.js', '/assets/emotion-cache.js', '/assets/index-a1b2.js', '/assets/three.css']) assert.doesNotMatch(miss, pattern, miss);

433});

434

435test('browser checks reference covers the harness and every case', async () => {

436 assert.ok(existsSync(reference), 'references/browser-checks.md');

437 const body = await readFile(reference, 'utf8');

438 assert.match(body, /\(\.\.\/scripts\/site-check\.template\.mjs\)/);

439 assert.match(body, /dev dependency/i);

440 assert.match(body, /approv/i);

441 for (const pattern of [/free port|port 0/i, /headers/i, /CSP/, /PID/, /frozen/i, /emulateMedia/, /Save-Data/, /hardwareConcurrency/, /addInitScript/,

442 /WEBGL_lose_context/, /draw call/i, /requestAnimationFrame|rAF/, /JavaScript off|javaScriptEnabled/i, /data-state/, /orphan/i, /glyph/i,

443 /overflow/i, /tel:/, /live (email|API key|key)/i, /pixel diff/i, /3 px/, /determinis/i, /hidden pane: motion unverified/,

444 /skipped/, /\$SITE_DIR/, /finally/]) {

445 assert.match(body, pattern, String(pattern));

446 }

447 assert.ok(body.split('\n').length <= 220, 'reference stays a reference');

448});

449