catalyst-os: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

catalyst-os: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node .catalyst/bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node .catalyst/bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

5"postinstall": "node .catalyst/bin/install.js", "validate": "

Medium

Ai Review Evidence

package.json automatically runs the installer after installation.

package.jsonView on unpkg · L5

.catalyst/bin/install.jsView file

34name: 'Claude Code', L35: dir: '.claude', L36: commandsDir: 'commands', ... L46: name: 'OpenAI Codex', L47: dir: '.codex', L48: commandsDir: 'prompts', ... L111: console.log(` ${yellow}? Which AI coding harness do you use?${reset}`); L112: console.log(` ${cyan}1)${reset} Claude Code ${dim}(.claude/)${reset} ${dim}[default]${reset}`); L113: console.log(` ${cyan}2)${reset} Pi ${dim}(.pi/)${reset}`); L114: console.log(` ${cyan}3)${reset} OpenAI Codex ${dim}(.codex/)${reset}`); L115: console.log(` ${cyan}4)${reset} All ${dim}(Claude Code + Pi + Codex)${reset}\n`); ... L155: /**

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

.catalyst/bin/install.jsView on unpkg · L34

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. code', 'claudecode'].includes(val)) return 'claude'; if (['2', 'pi'].includes(val)) return 'pi'; if (['3', 'codex', 'openai', 'openai-codex'].includes(val)) return 'codex'; if (['4', 'all', 'both', 'every'].includes(val)) return 'all'; return null; } async function resolveharness(cliharness) { if (cliharness) { const normalized = normalizeharness(cliharness); if (normalized) return normalized; console.log(` ${yellow}warning:${reset} unknown harness '${cliharness}'. defaulting to claude code.\n`); return 'claude'; } if (process.en

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

.catalyst/bin/install.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = catalyst-os@3.10.0 matchedPath = .catalyst/bin/install.js matchedIdentity = npm:Y2F0YWx5c3Qtb3M:3.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.catalyst/bin/install.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 86cbee9394a9829a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = catalyst-os@3.10.0 matchedPath = .catalyst/bin/install.js matchedIdentity = npm:Y2F0YWx5c3Qtb3M:3.10.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

.catalyst/bin/install.jsView on unpkg

334const src = path.join(__dirname, '../..'); const cwd = process.cwd(); cons

Medium

Ai Review Evidence

The installer targets the current working directory and skips copying files onto themselves.

.catalyst/bin/install.jsView on unpkg · L334

169function copyFileWithRewrite(src, dest, targetPrefix = '.claude', commandsDir = 'commands') { if (!fs.existsSync(src)) return false; if (path.resolve(src) === path.resolve(dest)) return true; // Don't copy onto itself fs.mkdirSy

Medium

Ai Review Evidence

The installer targets the current working directory and skips copying files onto themselves.

.catalyst/bin/install.jsView on unpkg · L169

.catalyst/bin/install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.catalyst/bin/install.js#virtual:normalized:round1View on unpkg

Lines 314-354javascript

314 ${cyan}codex${reset} OpenAI Codex (.codex/ directory, prompt templates in prompts/)

315 ${cyan}all${reset} Install for Claude Code, Pi, and Codex simultaneously

316

317 ${yellow}What gets installed:${reset}

318 ${dim}<harness-dir>/${reset} Agents, skills, rules, and commands/prompts

319 ${dim}.catalyst/${reset} Spec templates, project config, and bin/board.js (dashboard generator)

320 ${dim}AGENTS.md${reset} Universal instructions, architecture, and agent registry

321

322 ${yellow}Example:${reset}

323 ${dim}# Interactive setup${reset}

324 npx catalyst-os

325

326 ${dim}# Directly initialize for Pi${reset}

327 npx catalyst-os --harness pi

328`);

329 process.exit(0);

330 }

331

332 const selectedHarness = await resolveHarness(cliHarness);

333

334 const src = path.join(__dirname, '../..');

335 const cwd = process.cwd();

336

337 console.log(` Installing Catalyst OS to ${cyan}${cwd}${reset}\n`);

Medium

Ai Review Evidence

The installer targets the current working directory and skips copying files onto themselves.

.catalyst/bin/install.jsView on unpkg · L334

338

339 const catalystDir = path.join(cwd, '.catalyst');

340

341 // Harnesses already installed here are refreshed too: updating only the selected one

342 // leaves the others on an old framework version that still loads and runs.

343 const targetHarnesses = selectedHarness === 'all' ? ['claude', 'pi', 'codex'] : [selectedHarness];

344 for (const h of detectInstalledHarnesses(cwd)) {

345 if (!targetHarnesses.includes(h)) {

346 targetHarnesses.push(h);

347 console.log(` ${dim}•${reset} Also refreshing existing ${HARNESS_CONFIGS[h].dir}/ so it does not go stale\n`);

348 }

349 }

350 // AGENTS.md and templates can point at one harness dir only; prefer .claude when present.

351 const primaryHarness = targetHarnesses.includes('claude') ? 'claude' : targetHarnesses[0];

352 const primaryDir = HARNESS_CONFIGS[primaryHarness].dir;

353 const primaryCommandsDir = HARNESS_CONFIGS[primaryHarness].commandsDir;

354 for (const h of targetHarnesses) {