Loading npm security reports…

bumper-guard@0.2.12: Malicious npm security report (Block) | LPM Firewall

registry / bumper-guard / 0.2.12

bumper-guard@0.2.12

A plain-language safety net for vibe coders. Pauses risky things your AI assistant (Claude Code, Cursor, Codex CLI, Copilot CLI) is about to do, explains them in plain English, and lets you decide.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installation automatically modifies detected user-level Claude Code, Cursor, Copilot, and Codex control settings. It also starts a background process and configures automatic startup.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

The package gains control over pre-tool execution decisions across detected AI-agent environments without an explicit setup command.

Mechanism

Automatic AI-agent hook injection with daemon persistence.

Attack narrative

On npm installation, the postinstall script searches for installed AI-agent directories and silently rewrites their global hook or approval configuration. It then starts its daemon detached and creates an operating-system login-start entry. These actions affect foreign AI-agent control surfaces and persist beyond the install, without requiring the user to run the documented setup commands.

Rationale

This is concrete, unconsented postinstall mutation of broad AI-agent control surfaces combined with persistence. It meets the install-hook-abuse blocking policy regardless of the package's stated safety purpose.

Evidence

package.jsonsrc/installers/postinstall.jssrc/installers/claude-code.jssrc/installers/cursor.jssrc/installers/codex.jssrc/installers/autostart.js~/.claude/settings.json~/.cursor/hooks.json

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/installers/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node src/installers/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/installers/autostart.jsView file

3Trigger-reachable persistence chain: scripts.postinstall -> src/installers/postinstall.js -> src/installers/autostart.js L3: const path = require("path"); L4: const { execFileSync } = require("child_process"); L5: ... L10: L11: const BIN_PATH = path.join(__dirname, "..", "..", "bin", "bumper.js"); L12: const LAUNCH_AGENT_LABEL = "com.bumper.autostart"; ... L26: const WIN_STARTUP_DIR = () => L27: path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup"); L28: const WIN_LAUNCHER_PATH = () => path.join(WIN_STARTUP_DIR(), "BumperAutostart.vbs"); ... L79: fs.writeFileSync(LAUNCH_AGENT_PATH, plistContents()); L80: run("launchctl", ["load", "-w", LAUNCH_AGENT_PATH]); L81: return { platform: "darwin", mechanism: "

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/installers/autostart.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/installers/autostart.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/installers/autostart.jsView on unpkg

3const path = require("path"); L4: const { execFileSync } = require("child_process"); L5: ... L10: L11: const BIN_PATH = path.join(__dirname, "..", "..", "bin", "bumper.js"); L12: const LAUNCH_AGENT_LABEL = "com.bumper.autostart"; ... L26: const WIN_STARTUP_DIR = () => L27: path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "Microsoft", "Windows", "Start Menu", "Programs", "Startup"); L28: const WIN_LAUNCHER_PATH = () => path.join(WIN_STARTUP_DIR(), "BumperAutostart.vbs"); ... L79: fs.writeFileSync(LAUNCH_AGENT_PATH, plistContents()); L80: run("launchctl", ["load", "-w", LAUNCH_AGENT_PATH]); L81: return { platform: "darwin", mechanism: "launchd LaunchAgent", ref: LAUNCH_AGENT_PATH };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/installers/autostart.jsView on unpkg · L3

bin/bumper.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = bin/bumper.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bumper.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0bbcb33579b577de signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = bumper-guard@0.2.11 matchedPath = bin/bumper.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 shingleOverlap = 20 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/bumper.jsView on unpkg

src/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/daemon.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/daemon.jsView on unpkg

src/account.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/account.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/account.jsView on unpkg

src/policy.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/policy.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/policy.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "bumper-guard",

3 "version": "0.2.12",

4 "description": "A plain-language safety net for vibe coders. Pauses risky things your AI assistant (Claude Code, Cursor, Codex CLI, Copilot CLI) is about to do, explains them in plain English, and lets you decide.",

5 "bin": {

6 "bumper": "bin/bumper.js"

7 },

8 "main": "src/daemon.js",

9 "type": "commonjs",

10 "files": [

11 "bin",

12 "src",

13 "bumper.policy.example.yaml",

14 "README.md",

15 "LICENSE"

16 ],

17 "scripts": {

18 "start": "node bin/bumper.js start",

19 "postinstall": "node src/installers/postinstall.js || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "@modelcontextprotocol/sdk": "^1.12.0",

23 "commander": "^12.1.0",

24 "express": "^4.21.2",

25 "js-yaml": "^4.1.0",

26 "zod": "^3.23.8"

27 },

28 "engines": {

29 "node": ">=18"

30 },

31 "license": "SEE LICENSE IN LICENSE",

32 "homepage": "https://bumper-guard.pages.dev"

33}

34

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/installers/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const os = require("os");

3const path = require

bin/bumper.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = bin/bumper.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bumper.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0bbcb33579b577de signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = bumper-guard@0.2.11 matchedPath = bin/bumper.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 shingleOverlap = 20 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/bumper.jsView on unpkg

src/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/daemon.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/daemon.jsView on unpkg

src/account.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/account.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/account.jsView on unpkg

src/policy.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.11 matchedPath = src/policy.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/policy.jsView on unpkg