Loading npm security reports…

codeseeker@2.1.2: AI-agent control-surface risk | LPM Firewall

registry / codeseeker / 2.1.2

codeseeker@2.1.2

Graph-powered code intelligence for Claude Code. Semantic search + knowledge graph for better AI code understanding.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The install hook can alter broad, user-level AI-agent instruction files. It changes future agent behavior to prioritize this package's tools.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs the postinstall hook; pressing Enter at its update prompt accepts the change.

Impact

Global AI-agent control surfaces can be changed during dependency installation without an explicit affirmative response.

Mechanism

The hook finds instruction files below the user home directory and appends or replaces CodeSeeker guidance using synchronous file writes.

Policy narrative

Installing the package automatically launches a postinstall hook that searches multiple global AI-agent instruction locations. Its update prompt accepts an empty response as approval, then writes mandatory CodeSeeker guidance into existing files. This persists a package-selected instruction across future projects and agents.

AI rationale

The automatic lifecycle hook modifies a foreign, broad AI-agent control surface, and its default-empty response authorizes the write. This is concrete install-hook-based AI-agent control hijacking.

Evidence

package.jsonscripts/postinstall.js

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/services/data/semantic-graph/semantic-graph.jsView file

24patternName = generic_password severity = medium line = 24

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/services/data/semantic-graph/semantic-graph.jsView on unpkg · L24

dist/shared/post-execution-integration.jsView file

12const validation_cycle_1 = require("./validation-cycle"); L13: const child_process_1 = require("child_process"); L14: const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/shared/post-execution-integration.jsView on unpkg · L12

14const util_1 = require("util"); L15: const execAsync = (0, util_1.promisify)(child_process_1.exec); L16: class PostExecutionIntegration {

High

Shell

Package source references shell execution.

dist/shared/post-execution-integration.jsView on unpkg · L14

dist/cli/quality/services/compilation-service.jsView file

121// Basic syntax check - try to parse with Node L122: new Function(content); L123: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/quality/services/compilation-service.jsView on unpkg · L121

bin/codeseeker.jsView file

10L11: const path = require('path'); L12: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/codeseeker.jsView on unpkg · L10

dist/utils/cache.jsView file

179const content = await fs.readFile(filePath, 'utf8'); L180: const data = JSON.parse(content); L181: // Check if expired

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/utils/cache.jsView on unpkg · L179

dist/shared/change-assessment-system.jsView file

44const path = __importStar(require("path")); L45: const child_process_1 = require("child_process"); L46: class ChangeAssessmentSystem { ... L50: this.logger = logger_1.Logger.getInstance(); L51: this.claudeCodeApiUrl = process.env.CLAUDE_CODE_API_URL || 'http://localhost:3007'; L52: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/shared/change-assessment-system.jsView on unpkg · L44

scripts/postinstall.jsView file

121// Claude Code - user-level config L122: { path: '.claude/CLAUDE.md', name: 'Claude Code', create: true }, L123: { path: '.claude/settings/claude_desktop_config.json', name: 'Claude Desktop', create: false }, // JSON needs special handling L124: L125: // Cursor - user-level rules L126: { path: '.cursor/rules', name: 'Cursor (global rules)', create: true }, L127: { path: '.cursorrules', name: 'Cursor (home)', create: true }, L128: ... L156: // Generic agent files in home directory L157: { path: 'AGENTS.md', name: 'Generic AGENTS.md', create: true }, L158: { path: '.ai/instructions.md', name: 'Generic AI instructions', create: true }, ... L282:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L121

dist/cli/quality/compilation-checker.jsView file

42const warnings = []; L43: const tscProcess = (0, child_process_1.spawn)('npx', ['tsc', '--noEmit'], { L44: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/quality/compilation-checker.jsView on unpkg · L42

dist/orchestrator/claude-tool-orchestrator.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/orchestrator/claude-tool-orchestrator.js#virtual:normalized:round1View on unpkg

dist/cli/services/claude/claude-code-executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = codeseeker@2.0.2 matchedIdentity = npm:Y29kZXNlZWtlcg:2.0.2 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/services/claude/claude-code-executor.jsView on unpkg

dist/cli/services/data/semantic-graph/services/graph-storage-service.jsView file

16patternName = generic_password severity = medium line = 16

Medium

Secret Pattern

Hardcoded password in dist/cli/services/data/semantic-graph/services/graph-storage-service.js

dist/cli/services/data/semantic-graph/services/graph-storage-service.jsView on unpkg · L16