registry / AI-agent control-surface risk / code-brain
code-brain
Turn any codebase into searchable knowledge for Claude Code. LLM Wiki + AST Index + MCP Server.
This report shows the evidence for code-brain@0.9.0, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms concrete install-time writes into Claude Code control files, including persistent hooks that affect later agent behavior. Under the provided policy, unconsented npm postinstall mutation of a foreign/broad AI-agent control surface is blocking even without exfiltration. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall on package install or upgrade
Impact
Alters Claude Code behavior for the project without an explicit user command, steering agent tool choice and executing package CLI hooks in future sessions.
Mechanism
postinstall AI-agent control surface mutation
Policy narrative
Installing code-brain runs scripts/postinstall.cjs, which locates the consumer project root and writes Claude Code skill/instruction files plus .claude/settings.json hooks. Those hooks later execute npx code-brain session-start and pre-tool-nudge to inject context into Claude sessions and Grep tool use. The behavior is package-aligned and documented, but it is still unconsented postinstall mutation of a broad AI-agent control surface.
AI rationale
Source inspection confirms concrete install-time writes into Claude Code control files, including persistent hooks that affect later agent behavior. Under the provided policy, unconsented npm postinstall mutation of a foreign/broad AI-agent control surface is blocking even without exfiltration. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsonscripts/postinstall.cjsdist/hooks/adoption-hooks.jsskill/SKILL.mdbin/code-brain.jsdist/db/better-sqlite-driver.js.claude/skills/code-brain/SKILL.mdCLAUDE.md.claude/settings.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 93.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall: node scripts/postinstall.cjs || true
- scripts/postinstall.cjs writes .claude/skills/code-brain/SKILL.md during install
- scripts/postinstall.cjs creates/appends CLAUDE.md with code-brain instructions
- scripts/postinstall.cjs mutates .claude/settings.json hooks to run npx code-brain session-start and pre-tool-nudge
- dist/hooks/adoption-hooks.js injects SessionStart and PreToolUse context steering Claude tool choice
Evidence against
- README.md openly documents the auto-wired Claude hooks
- Hook commands are package-aligned and call local code-brain CLI behavior
- No credential harvesting or exfiltration endpoints found in inspected files
- Dynamic require in dist/db/better-sqlite-driver.js only loads optional better-sqlite3
- Shell use is limited to user-invoked CLI features such as graph opener and git helpers
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/db/better-sqlite-driver.jsView file
4import path from "node:path";
L5: const require = createRequire(import.meta.url);
L6: /** Soft warning threshold — log when DB exceeds this */
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/db/better-sqlite-driver.jsView on unpkg · L4Findings
1 Critical2 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/db/better-sqlite-driver.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to code-brain@0.9.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing code-brain@0.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.