registry / brainforge-kit / 0.3.0-beta.3

brainforge-kit@0.3.0-beta.3

Conversational workspaces, agents and workflows for AI assistants.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation modifies the consumer project's shared assistant instructions, prompt hooks, and command permissions without asking for consent.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A local npm installation with lifecycle scripts enabled, outside the explicit skip conditions.

Impact

Future assistant sessions receive package-controlled instructions and prompt hooks, while Claude gains permission allowances for package synchronization commands.

Mechanism

The postinstall hook invokes project initialization, which appends assistant directives and enables agent hook configuration by default.

Policy narrative

Installing the package locally automatically initializes the consumer project. Initialization appends directives to shared assistant instruction files, installs skills, merges prompt hooks into Claude and Codex configuration, and adds Claude command permissions. These changes activate without a consent prompt and extend beyond package-owned configuration into the project's agent control surfaces. Skip flags and preservation checks limit execution and file damage but do not authorize these changes.

AI rationale

The inspected lifecycle chain performs unconsented installation-time mutation of broad AI-agent control surfaces, meeting the supplied blocking policy. This conclusion rests on executable configuration writes, without requiring evidence of credential theft or remote payload execution.

Evidence

package.jsonpostinstall.mjsinit-project.mjsAGENTS.mdCLAUDE.md.claude/settings.json.codex/hooks.json.agents/skills/brainforge-start/SKILL.md.claude/skills/brainforge-start/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json automatically runs postinstall.mjs, which calls initProject on the installing project without a consent prompt.
init-project.mjs appends package instructions to AGENTS.md and CLAUDE.md and installs agent skills.
Project setup enables Claude and Codex prompt hooks by default.
The hook merger adds Claude command permission allowances for team synchronization.
Injected instructions direct assistants to load package procedures when the user states a goal and perform further setup themselves.

Evidence against

Installation skips CI, global installs, and locations outside the installing project's node_modules.
The installer rejects symbolic-link destinations and preserves existing instruction text outside its own block.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 116 file(s), 996 KB of source, external domains: 127.0.0.1, api.typesafe.ai, docs.typesafe.ai, example.com, learn.chatgpt.com, motion.dev, openrouter.ai, vercel.com

Source & flagged code

9 flagged

package.jsonView file

Lines 23-47json

23 "THIRD_PARTY_NOTICES.md",

24 "!**/*.test.mjs",

25 "!**/*-smoke.mjs",

26 "!**/smoke.mjs",

27 "!**/selftest.sh",

28 "!**/*-selftest.sh",

29 "!**/selftest.mjs",

30 "!**/*-selftest.mjs",

31 "!**/ROLLOUT-*.md"

32 ],

33 "publishConfig": {

34 "access": "public",

35 "tag": "beta"

36 },

37 "engines": {

38 "node": ">=22"

39 },

40 "scripts": {

41 "doctor": "node brainforge.mjs doctor",

42 "test": "node --test tests/*.test.mjs \"tests/evals/*.test.mjs\" agent-kit/bootstrap/*.test.mjs agent-kit/hooks/*.test.mjs",

43 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 },

45 "license": "MIT"

46}

init-project.mjsView file

Lines 1-41javascript

1import fs from 'node:fs';

2import path from 'node:path';

3import { randomUUID } from 'node:crypto';

4import { createHash } from 'node:crypto';

onboarding/skills/premium-web-design/tests/reveal.browser.check.mjsView file

Lines 12-43javascript

12 await page.addScriptTag({ path: fileURLToPath(new URL('../assets/motion-lab/vendor/motion-13.4.4.js', import.meta.url)) });

13 await page.addScriptTag({ path: fileURLToPath(

runtime/scope-verify.mjsView file

Lines 19-59javascript

19// node runtime/scope-verify.mjs --owners src/a.tsx --root <project>

20// node runtime/scope-verify.mjs --scopes-drift --root <project> [--strict]

21// node runtime/scope-verify.mjs --catalog-scopes --track web-saas [--agents a,b] [--project name]

22// Exit 0 = nothing denied, 2 = at least one denial, 1 = could not verify.

23import fs from "node:fs";

24import path from "node:path";

onboarding/skills/premium-web-design/tests/integrity.check.mjsView file

Lines 1-28javascript

1import test from 'node:test';

2import assert from 'node:assert/strict';

3import { readFile, readdir } from 'node:fs/promises';

4import { createHash } from

agent-kit/hooks/scope-guard.mjsView file

Lines 1102-1142javascript

1102 continue;

1103 }

1104 if (first === "case" && !tokens[0].quoted) {

1105 const arm =

runtime/catalog-index.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/catalog-index.mjs#virtual:string-array:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

init-project.mjsView file

21Install-time code directly mutates a foreign AI-agent control surface: L21: if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) throw new Error('The target must be an existing project directory.'); L22: for (const rel of ['', '.brainforge', '.brainforge/kit', '.brainforge/workspace', '.brainforge/workspace/kit-backups', '.agents', '.agents/skills', '.agents/skills/brainforge-start... L23: const part = path.join(target, rel); ... L48: else { L49: fs.writeFileSync(file, old.slice(0, begin) + current + old.slice(end + blockEnd.length), 'utf8'); L50: report.updated.push(name); ... L61: const block = instruction.replaceAll('\n', eol); L62: fs.writeFileSync(file, old + (old && !old.endsWith('\n') ? eol : '') + (old ? eol : '') + block, 'utf8'); L63: report.appended.push(name); ...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

init-project.mjsView on unpkg · L21

5import { fileURLToPath } from 'node:url'; L6: import { spawnSync } from 'node:child_process'; L7:

High

Child Process

Package source references child process execution.

init-project.mjsView on unpkg · L5

onboarding/skills/premium-web-design/tests/reveal.browser.check.mjsView file

32for (const action of ['effect.setPaused(false)', 'effect.setPaused(true); effect.setPaused(false)', 'effect.destroy(); window.effect = MotionKit.inViewReveal(document)']) { L33: assert.equal(await page.evaluate(action => { eval(action); return getComputedStyle(document.querySelector('[data-reveal]')).opacity; }, action), '1', action); L34: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

onboarding/skills/premium-web-design/tests/reveal.browser.check.mjsView on unpkg · L32

runtime/scope-verify.mjsView file

39try { L40: return await import(pathToFileURL(enginePath).href); L41: } finally {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime/scope-verify.mjsView on unpkg · L39

onboarding/skills/premium-web-design/tests/integrity.check.mjsView file

8test('provenance hashes cover every distributed asset and embedded font', async () => { L9: const manifest = JSON.parse(await read('provenance.json')); L10: assert.ok(Array.isArray(manifest.files), 'manifest must hash distributed files'); ... L47: const code = await read(name); L48: assert.equal(/localStorage|sessionStorage|fetch\s*\(|XMLHttpRequest|sendBeacon|postMessage|window\.parent|window\.top/.test(code), false, name); L49: assert.equal(/[A-Z]:[\\/]/.test(code), false, name);

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

onboarding/skills/premium-web-design/tests/integrity.check.mjsView on unpkg · L8

agent-kit/hooks/scope-guard.mjsView file

1122if (!tokens.length && targets.length) return { kind: "fsMutation", cmd: "redirect", paths: targets }; L1123: // `npx pkg@ver …` / `bunx …` / `pnpm dlx …` run the package: judge the package. L1124: tokens = unwrapRunner(tokens); ... L1130: L1131: // PowerShell .NET file API ([System.IO.File]::WriteAllText(...)) — a write L1132: // with no cmdlet and no shell operator. Paths hide inside the call: deny.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

agent-kit/hooks/scope-guard.mjsView on unpkg · L1122

runtime/catalog-index.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/catalog-index.mjs#virtual:string-array:round1View on unpkg

Findings

1 Critical4 High6 Medium5 Low

CriticalAi Agent Control Hijackinit-project.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processinit-project.mjs

HighRuntime Package Installagent-kit/hooks/scope-guard.mjs

HighSemantic Analysis Limitedruntime/catalog-index.mjs#virtual:string-array:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireruntime/scope-verify.mjs

MediumUnsafe Vm Contextonboarding/skills/premium-web-design/tests/integrity.check.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalonboarding/skills/premium-web-design/tests/reveal.browser.check.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to brainforge-kit@0.3.0-beta.3.

See version security history for other recorded verdicts.

Avoid installing brainforge-kit@0.3.0-beta.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 02:55:41.878Z (UTC).

99%Malicious

AI assessment confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

This finding concerns changes to an AI agent's instructions or configuration without explicit user action. It does not by itself establish malware intent. The CLI warns by default and blocks when configured for this policy.

Package metadata

npm

Version0.3.0-beta.3

PublishedSep 30, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size1.26 MB

Files491

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → brainforge-kit

Runtimenode >=22

Artifact3.64 MB · 491 files2 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkHighEntropyStringsMinifiedUrlStringsManifest: clean