catalyst-os@3.10.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

catalyst-os@3.10.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node .catalyst/bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"scripts": { "postinstall": "node .catalyst/bin/install.js", "validate": "node .

High

Suspicious Lifecycle Evidence

The package runs its installer automatically through a postinstall hook.

package.jsonView on unpkg · L4

•scripts.postinstall = node .catalyst/bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.catalyst/bin/install.jsView file

34name: 'Claude Code', L35: dir: '.claude', L36: commandsDir: 'commands', ... L46: name: 'OpenAI Codex', L47: dir: '.codex', L48: commandsDir: 'prompts', ... L111: console.log(` ${yellow}? Which AI coding harness do you use?${reset}`); L112: console.log(` ${cyan}1)${reset} Claude Code ${dim}(.claude/)${reset} ${dim}[default]${reset}`); L113: console.log(` ${cyan}2)${reset} Pi ${dim}(.pi/)${reset}`); L114: console.log(` ${cyan}3)${reset} OpenAI Codex ${dim}(.codex/)${reset}`); L115: console.log(` ${cyan}4)${reset} All ${dim}(Claude Code + Pi + Codex)${reset}\n`); ... L155: /**

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

.catalyst/bin/install.jsView on unpkg · L34

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. code', 'claudecode'].includes(val)) return 'claude'; if (['2', 'pi'].includes(val)) return 'pi'; if (['3', 'codex', 'openai', 'openai-codex'].includes(val)) return 'codex'; if (['4', 'all', 'both', 'every'].includes(val)) return 'all'; return null; } async function resolveharness(cliharness) { if (cliharness) { const normalized = normalizeharness(cliharness); if (normalized) return normalized; console.log(` ${yellow}warning:${reset} unknown harness '${cliharness}'. defaulting to claude code.\n`); return 'claude'; } if (process.en

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

.catalyst/bin/install.jsView on unpkg

102// If in CI, default to Claude Code immediately if (process.env.CI) { return 'claude'; } return new Promise((res

High

Ai Review Evidence

In CI, the installer selects the Claude harness without prompting.

.catalyst/bin/install.jsView on unpkg · L102

246if (fs.existsSync(path.join(targetDir, 'agents'))) { console.log(` ${yellow}Warning:${reset} ${config.dir}/agents already exists`); console.log(` ${dim}Files will be overwritten${reset}`); } // Install agents const agentsSrc = path.join(src, '.claude', 'agents'); const agentsDest = path.join(targetDir, 'agents'); if (fs.existsSync(agentsSrc)) { copyDirWithRewrite(agentsSrc, agentsDest, config.dir, co

High

Ai Review Evidence

The installer overwrites existing agent files and copies bundled agents and commands into harness directories.

.catalyst/bin/install.jsView on unpkg · L246

251// Install agents const agentsSrc = path.join(src, '.claude', 'agents'); const agentsDest = path.join(targetDir, 'agents'); if (fs.existsSync(agentsSrc)) { copyDirWithRewrite(agentsSrc, agentsDest, config.dir, config.commandsDir); console.log(` ${green}✓${reset} Installed ${config.dir}/agents`); } // Install commands/prompts const commandsSrc = path.join(src, '.claude', 'commands'); const commandsDest = path.join(targetDir, config.commandsDir); if (fs.existsSync(commandsSrc)) { copyDirWithRewrite(commandsSrc, commandsDest, config.dir, confi

High

Ai Review Evidence

The installer overwrites existing agent files and copies bundled agents and commands into harness directories.

.catalyst/bin/install.jsView on unpkg · L251

343const targetHarnesses = selectedHarness === 'all' ? ['claude', 'pi', 'codex'] : [selectedHarness]; for (const h of detectInstalledHarnesses(cwd)) { if (!targetHarnesses.includes(h)) { targetHarnesses.push(h); console.log(` ${dim}•${reset} Also refreshing existing ${HARNESS_CONFIGS[h].dir}/ so it does not go stale\n`); } } // AGENTS.md and templates can poin

High

Ai Review Evidence

The installer also refreshes other detected harness directories, beyond the selected target.

.catalyst/bin/install.jsView on unpkg · L343

.catalyst/bin/install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.catalyst/bin/install.js#virtual:normalized:round1View on unpkg

Lines 226-271javascript

226}

227

228/**

229 * Harnesses whose agents/ dir already exists in the project

230 */

231function detectInstalledHarnesses(cwd) {

232 return Object.keys(HARNESS_CONFIGS).filter((key) =>

233 fs.existsSync(path.join(cwd, HARNESS_CONFIGS[key].dir, 'agents'))

234 );

235}

236

237/**

238 * Install agents, commands/prompts, skills, and rules for a specific harness

239 */

240function installHarness(harnessKey, src, cwd) {

241 const config = HARNESS_CONFIGS[harnessKey];

242 const targetDir = path.join(cwd, config.dir);

243

244 console.log(` ${cyan}Configuring ${config.name}${reset} ${dim}(${config.dir}/)${reset}:`);

245

246 if (fs.existsSync(path.join(targetDir, 'agents'))) {

247 console.log(` ${yellow}Warning:${reset} ${config.dir}/agents already exists`);

248 console.log(` ${dim}Files will be overwritten${reset}`);

249 }

250

251 // Install agents

252 const agentsSrc = path.join(src, '.claude', 'agents');

253 const agentsDest = path.join(targetDir, 'agents');

254 if (fs.existsSync(agentsSrc)) {

255 copyDirWithRewrite(agentsSrc, agentsDest, config.dir, config.commandsDir);

High

Ai Review Evidence

The installer overwrites existing agent files and copies bundled agents and commands into harness directories.

.catalyst/bin/install.jsView on unpkg · L246

256 console.log(` ${green}✓${reset} Installed ${config.dir}/agents`);

257 }

258

259 // Install commands/prompts

260 const commandsSrc = path.join(src, '.claude', 'commands');

261 const commandsDest = path.join(targetDir, config.commandsDir);

262 if (fs.existsSync(commandsSrc)) {

High

Ai Review Evidence

The installer overwrites existing agent files and copies bundled agents and commands into harness directories.

.catalyst/bin/install.jsView on unpkg · L251

263 copyDirWithRewrite(commandsSrc, commandsDest, config.dir, config.commandsDir);

264 console.log(` ${green}✓${reset} Installed ${config.dir}/${config.commandsDir} ${config.commandsDir === 'prompts' ? '(prompt templates)' : '(slash commands)'}`);

265 }

266

267 // Install skills

268 const skillsSrc = path.join(src, '.claude', 'skills');

269 const skillsDest = path.join(targetDir, 'skills');

270 if (fs.existsSync(skillsSrc)) {

271 copyDirWithRewrite(skillsSrc, skillsDest, config.dir, config.commandsDir);