registry / AI-agent control-surface risk / coder-config
coder-config
Configuration manager for AI coding tools - Claude Code, Gemini CLI, Codex CLI, Antigravity. Manage MCPs, rules, permissions, memory, and workstreams.
This report shows the evidence for coder-config@0.54.7, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe unconditional postinstall writes to ~/.claude, which is a broad foreign AI-agent control surface. Per policy this concrete unconsented mutation warrants blocking even though the defaults are transparent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall
Impact
Changes Claude Code global configuration at dependency-install time and can rebuild native dependency code.
Mechanism
Unconsented global AI-agent configuration creation
Policy narrative
On package installation, package.json runs scripts/postinstall.js. That script creates the user's ~/.claude directory and default config.json and registry.json without an explicit coder-config command, then tests node-pty and may execute npm rebuild node-pty. This is install-time mutation of a foreign global AI-agent configuration surface.
AI rationale
The unconditional postinstall writes to ~/.claude, which is a broad foreign AI-agent control surface. Per policy this concrete unconsented mutation warrants blocking even though the defaults are transparent.
Evidence
package.jsonscripts/postinstall.js~/.claude~/.claude/config.json~/.claude/registry.jsonnode_modules/node-pty
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json unconditionally runs postinstall.
- scripts/postinstall.js creates ~/.claude and writes config.json and registry.json during install.
- Postinstall also runs a subprocess and conditionally invokes npm rebuild node-pty.
Evidence against
- No network or credential-exfiltration code appears in the inspected postinstall path.
- Written files contain visible default configuration rather than an embedded remote payload.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgui/server.cjsView file
12const os = require('os');
L13: const { spawn } = require('child_process');
L14: const TerminalServer = require('./terminal-server.cjs');
High
Findings
1 Critical6 High7 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processui/server.cjs
HighShell
HighSandbox Evasion Gated Capabilitycli.js
HighTrigger Reachable Persistencecli.js
HighRuntime Package Installui/routes/updates.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireui/dist/assets/index-B5XhwJiF.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencescripts/preuninstall.js
MediumShips Build Helpershell/coder-config.zsh
Affected versions and remediation
This report applies to coder-config@0.54.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing coder-config@0.54.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.