Loading npm security reports…

catalyst-os@3.8.1: AI-agent control-surface risk | LPM Firewall

registry / catalyst-os / 3.8.1

catalyst-os@3.8.1

AI-native spec-driven development framework for Claude Code, Pi, and Codex

AI Security Review

scanned 29d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package triggers code that modifies consumer AI-agent control directories. It defaults to Claude Code in CI or on closed input and can overwrite agent behavior files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

A dependency installation can replace or add consumer project agent instructions, skills, commands, rules, and entry bridges without explicit consent.

Mechanism

automatic broad AI-agent configuration overwrite

Policy narrative

The npm postinstall invokes the installer automatically. When no interactive selection is available, including CI, it chooses Claude Code, then recursively copies package-controlled agents, commands, skills, and rules into the consumer project and overwrites existing files. It also writes AGENTS.md and may add a CLAUDE.md bridge that causes those instructions to load. This is unconsented mutation of a foreign AI-agent control surface during dependency installation.

AI rationale

The package has a concrete automatic postinstall chain that defaults to and overwrites consumer AI-agent control files. This meets the install-control-surface blocking policy.

Evidence

package.json.catalyst/bin/install.js.claude/agents.claude/commands.claude/skills.claude/rules.pi/agents.pi/prompts.pi/skills.pi/rules.codex/agents.codex/prompts.codex/skills

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node .catalyst/bin/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4"scripts": { "postinstall": "node .catalyst/bin/install.js", "validate": "node .catalyst/bin/validate-artifacts.js", "test": "node .catalyst/bin/board.test.js && node .catalyst/bin/validate-artifacts.js"

High

Suspicious Lifecycle Evidence

Postinstall automatically runs the installer.

package.jsonView on unpkg · L4

•scripts.postinstall = node .catalyst/bin/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.catalyst/bin/install.jsView file

34name: 'Claude Code', L35: dir: '.claude', L36: commandsDir: 'commands', ... L46: name: 'OpenAI Codex', L47: dir: '.codex', L48: commandsDir: 'prompts', ... L111: console.log(` ${yellow}? Which AI coding harness do you use?${reset}`); L112: console.log(` ${cyan}1)${reset} Claude Code ${dim}(.claude/)${reset} ${dim}[default]${reset}`); L113: console.log(` ${cyan}2)${reset} Pi ${dim}(.pi/)${reset}`); L114: console.log(` ${cyan}3)${reset} OpenAI Codex ${dim}(.codex/)${reset}`); L115: console.log(` ${cyan}4)${reset} All ${dim}(Claude Code + Pi + Codex)${reset}\n`); ... L155: /**

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

.catalyst/bin/install.jsView on unpkg · L34

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. code', 'claudecode'].includes(val)) return 'claude'; if (['2', 'pi'].includes(val)) return 'pi'; if (['3', 'codex', 'openai', 'openai-codex'].includes(val)) return 'codex'; if (['4', 'all', 'both', 'every'].includes(val)) return 'all'; return null; } async function resolveharness(cliharness) { if (cliharness) { const normalized = normalizeharness(cliharness); if (normalized) return normalized; console.log(` ${yellow}warning:${reset} unknown harness '${cliharness}'. defaulting to claude code.\n`); return 'claude'; } if (process.en

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

.catalyst/bin/install.jsView on unpkg

102// If in CI, default to Claude Code immediately if (process.env.CI) { return 'claude'; }

.catalyst/bin/install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.catalyst/bin/install.js#virtual:normalized:round1View on unpkg

Lines 82-164javascript

82 if (!input) return null;

83 const val = input.trim().toLowerCase();

84 if (['1', 'claude', 'claude-code', 'claudecode'].includes(val)) return 'claude';

85 if (['2', 'pi'].includes(val)) return 'pi';

86 if (['3', 'codex', 'openai', 'openai-codex'].includes(val)) return 'codex';

87 if (['4', 'all', 'both', 'every'].includes(val)) return 'all';

88 return null;

89}

90

91/**

92 * Prompt user for harness selection if not supplied via CLI

93 */

94async function resolveHarness(cliHarness) {

95 if (cliHarness) {

96 const normalized = normalizeHarness(cliHarness);

97 if (normalized) return normalized;

98 console.log(` ${yellow}Warning:${reset} Unknown harness '${cliHarness}'. Defaulting to Claude Code.\n`);

99 return 'claude';

100 }

101

102 // If in CI, default to Claude Code immediately

103 if (process.env.CI) {

104 return 'claude';

105 }

High

Ai Review Evidence

In CI, installer defaults to Claude Code without a user choice.

.catalyst/bin/install.jsView on unpkg · L102

106

107 return new Promise((resolve) => {

108 let resolved = false;

109

110 if (process.stdin.isTTY) {

111 console.log(` ${yellow}? Which AI coding harness do you use?${reset}`);

112 console.log(` ${cyan}1)${reset} Claude Code ${dim}(.claude/)${reset} ${dim}[default]${reset}`);

113 console.log(` ${cyan}2)${reset} Pi ${dim}(.pi/)${reset}`);

114 console.log(` ${cyan}3)${reset} OpenAI Codex ${dim}(.codex/)${reset}`);

115 console.log(` ${cyan}4)${reset} All ${dim}(Claude Code + Pi + Codex)${reset}\n`);

116 }

117

118 const rl = readline.createInterface({

119 input: process.stdin,

120 output: process.stdout,

121 terminal: Boolean(process.stdin.isTTY),

122 });

124 const promptText = process.stdin.isTTY ? ' Select [1-4] (default: 1): ' : '';

125

126 rl.question(promptText, (answer) => {

127 if (resolved) return;

128 resolved = true;

129 rl.close();

130 const choice = answer.trim();

131 const normalized = normalizeHarness(choice);

132 if (normalized) {

133 resolve(normalized);

134 } else if (!choice) {

135 resolve('claude');

136 } else {

137 if (process.stdin.isTTY) {

138 console.log(` ${dim}Unrecognized selection '${choice}', defaulting to Claude Code.${reset}\n`);

139 }

140 resolve('claude');

141 }

142 });

143

144 rl.on('close', () => {

145 if (!resolved) {

146 resolved = true;

147 resolve('claude');

148 }

149 });

High

Ai Review Evidence

In CI, installer defaults to Claude Code without a user choice.

.catalyst/bin/install.jsView on unpkg · L144

150 });

151}

152

153const TEXT_EXTS = new Set(['.md', '.yaml', '.yml', '.json', '.txt', '.js', '.sh', '.py']);

154

155/**

156 * Rewrite path references (e.g. .claude/ -> .pi/) in text files

157 */

158function rewriteContent(content, targetPrefix, commandsDir) {

159 if (targetPrefix === '.claude') return content;

160 return content

161 .replaceAll('.claude/commands/', `${targetPrefix}/${commandsDir}/`)

162 .replaceAll('.claude/commands', `${targetPrefix}/${commandsDir}`)

163 .replaceAll('.claude/', `${targetPrefix}/`);

164}

Lines 217-257javascript

217 const lines = content.split(/\r?\n/).map((l) => l.trim());

218 const covered = lines.some(

219 (l) => l === guard || l === '/.catalyst' || l === '.catalyst' || l === '.catalyst/'

220 );

221 if (covered) return;

222 }

223 const block = `${content && !content.endsWith('\n') ? '\n' : ''}\n# Catalyst OS local secrets (never commit)\n${guard

224 fs.appendFileSync(gitignorePath, block);

225 console.log(` ${green}✓${reset} Added ${guard} to .gitignore`);

226}

227

228/**

229 * Install agents, commands/prompts, skills, and rules for a specific harness

230 */

231function installHarness(harnessKey, src, cwd) {

232 const config = HARNESS_CONFIGS[harnessKey];

233 const targetDir = path.join(cwd, config.dir);

234

235 console.log(` ${cyan}Configuring ${config.name}${reset} ${dim}(${config.dir}/)${reset}:`);

236

237 if (fs.existsSync(path.join(targetDir, 'agents'))) {

238 console.log(` ${yellow}Warning:${reset} ${config.dir}/agents already exists`);

239 console.log(` ${dim}Files will be overwritten${reset}`);

240 }

241

242 // Install agents

243 const agentsSrc = path.join(src, '.claude', 'agents');

244 const agentsDest = path.join(targetDir, 'agents');

245 if (fs.existsSync(agentsSrc)) {

246 copyDirWithRewrite(agentsSrc, agentsDest, config.dir, config.commandsDir);

High

Ai Review Evidence

Installer recursively overwrites agents, commands, skills, and rules in consumer AI-agent directories.

.catalyst/bin/install.jsView on unpkg · L237

247 console.log(` ${green}✓${reset} Installed ${config.dir}/agents`);

248 }

249

250 // Install commands/prompts

251 const commandsSrc = path.join(src, '.claude', 'commands');

252 const commandsDest = path.join(targetDir, config.commandsDir);

253 if (fs.existsSync(commandsSrc)) {

254 copyDirWithRewrite(commandsSrc, commandsDest, config.dir, config.commandsDir);

255 console.log(` ${green}✓${reset} Installed ${config.dir}/${config.commandsDir} ${config.commandsDir === 'prompts' ? '(prompt templates)' : '(slash commands)'}`);

256 }

257

Lines 379-419javascript

379 fs.mkdirSync(specsDir, { recursive: true });

380 console.log(` ${green}✓${reset} Created .catalyst/specs/`);

381 }

382

383 // Create local secrets file (git-ignored) if it doesn't exist yet

384 const secretsPath = path.join(catalystDir, 'secrets.local.yaml');

385 if (!fs.existsSync(secretsPath)) {

386 fs.writeFileSync(

387 secretsPath,

388 '# Catalyst OS — Local Secrets (git-ignored, never commit)\n' +

389 '# Optional. Only needed for /meet-spec voice meetings.\n' +

390 '# Get a key at https://elevenlabs.io (you pay for your own usage).\n' +

391 'elevenlabs_api_key: ""\n'

392 );

393 console.log(` ${green}✓${reset} Created .catalyst/secrets.local.yaml`);

394 }

395

396 // Safety belt: ensure local secrets file can never be committed

397 ensureGitignore(cwd);

398

399 // Install AGENTS.md (rewritten for selected harness)

400 const agentsMdSrc = path.join(src, 'AGENTS.md');

401 const agentsMdDest = path.join(cwd, 'AGENTS.md');

402 if (fs.existsSync(agentsMdSrc)) {

403 const targetDir = selectedHarness === 'pi' ? '.pi' : selectedHarness === 'codex' ? '.codex' : '.claude';

404 const commandsDir = selectedHarness === 'claude' ? 'commands' : 'prompts';

405 copyFileWithRewrite(agentsMdSrc, agentsMdDest, targetDir, commandsDir);

High

Ai Review Evidence

Installer adds an AGENTS bridge and overwrites AGENTS.md in the consumer project.

.catalyst/bin/install.jsView on unpkg · L399

406 console.log(` ${green}✓${reset} Installed AGENTS.md${selectedHarness !== 'claude' && selectedHarness !== 'all' ? ` (configured for ${targetDir}/)` : ''}`);

407 }

408

409 console.log(`

410 ${green}Done!${reset}

411

412 ${yellow}Next steps:${reset}

413 1. Run ${cyan}/catalyze-project${reset} to initialize your project

414 2. Run ${cyan}/catalyze-spec${reset} to create your first specification

415 3. Run ${cyan}/forge-spec${reset} to implement it

416

417 ${dim}Documentation: https://github.com/Ealikadioglu/catalyst-os${reset}

418`);

419}