Loading npm security reports…

copilot-framework@1.5.0: AI-agent control-surface risk | LPM Firewall

registry / copilot-framework / 1.5.0

copilot-framework@1.5.0

Contract-first Copilot scaffolding and workspace bootstrap scripts for Edenred repositories.

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently modifies the consuming repository's Copilot instruction and MCP control surfaces. The MCP configuration launches package code in the workspace.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install of the package in a non-production repository

Impact

Unconsented agent-control configuration and package-code launch registration in the consumer workspace.

Mechanism

postinstall scaffolds .github agent files and .vscode MCP configuration

Policy narrative

The automatic postinstall hook resolves the consumer project directory, creates or merges its VS Code MCP configuration, and registers a Node command that loads copilot-framework. It also copies package-supplied Copilot instruction and skills content into the consumer's .github directory, then ignores these artifacts in git. These mutations happen without an explicit setup command or consent prompt.

Rationale

This is a concrete unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. No separate exfiltration chain was needed for this verdict.

Evidence

package.jsonscripts/postinstall.jsworkspace/.vscode/mcp.jsonworkspace/.github/AGENTS.md.vscode/mcp.json.github/AGENTS.md.github/copilot-instructions.md.github/skills/.gitignorecontext/.ai-context/setup-telemetry.jsonl

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/edenred-copilot-framework.jsView file

1#!/usr/bin/env node L2: const { runCli } = require('../dist/cli.js'); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/edenred-copilot-framework.jsView on unpkg · L1

scripts/postinstall.jsView file

37const timestamp = new Date().toISOString(); L38: fs.mkdirSync(path.dirname(SETUP_TELEMETRY_PATH), { recursive: true }); L39: fs.appendFileSync( L40: SETUP_TELEMETRY_PATH, ... L56: function writePackManifest(packName, source, status, reason) { L57: fs.mkdirSync(KNOWLEDGE_PACK_STATE_DIR, { recursive: true }); L58: const manifest = { ... L65: }; L66: fs.writeFileSync(KNOWLEDGE_PACK_MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8'); L67: } ... L216: '.github/*.md', L217: '.github/AGENTS.md',

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L37

stacks/agenred-rag-api/cloud/provision-ado-repo.shView file

•path = stacks/agenred-rag-api/cloud/provision-ado-repo.sh kind = build_helper sizeBytes = 5890 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

stacks/agenred-rag-api/cloud/provision-ado-repo.shView on unpkg

docs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdfView file

•path = docs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdf kind = high_entropy_blob sizeBytes = 55962 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdfView on unpkg

dist/prompt-eval/provider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = copilot-framework@1.3.1 matchedIdentity = npm:Y29waWxvdC1mcmFtZXdvcms:1.3.1 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/prompt-eval/provider.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 13-49json

13 "files": [

14 "dist",

15 "bin",

16 "context-template",

17 "docs",

18 "scripts",

19 "stacks",

20 "workspace/.github",

21 "workspace/.vscode",

22 "README.md",

23 "CHANGELOG.md",

24 "VERSION"

25 ],

26 "scripts": {

27 "prebuild": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",

28 "build": "tsc -p tsconfig.json",

29 "typecheck": "tsc -p tsconfig.json --noEmit",

30 "pretest": "npm run build",

31 "test": "node --test dist/test/*.test.js dist/test/**/*.test.js",

32 "prepare": "npm run build",

33 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 "setup": "bash scripts/setup.sh",

35 "update": "bash scripts/update.sh",

36 "monthly-gains": "bash scripts/monthly-gains.sh",

37 "check": "bash -n scripts/setup.sh && bash -n scripts/update.sh"

38 },

39 "dependencies": {

40 "@lancedb/lancedb": "^0.22.0",

41 "apache-arrow": "^19.0.1",

42 "typescript": "^5.8.3",

43 "yaml": "^2.9.0"

44 },

45 "devDependencies": {

46 "@types/node": "^22.15.0"

47 }

48}

49

bin/edenred-copilot-framework.jsView file

Lines 1-5javascript

1#!/usr/bin/env node

2const { runCli } = require('../dist/cli.js');

3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/edenred-copilot-framework.jsView on unpkg · L1

4process.exitCode = runCli(process.argv.slice(

scripts/postinstall.jsView file

Lines 17-57javascript

17const KNOWLEDGE_PACK_MANIFEST_PATH = path.join(KNOWLEDGE_PACK_STATE_DIR, 'setup-manifest.json');

18const SETUP_TELEMETRY_PATH = path.join(TARGET_ROOT, '.ai-context', 'setup-telemetry.jsonl');

stacks/agenred-rag-api/cloud/provision-ado-repo.shView file

•path = stacks/agenred-rag-api/cloud/provision-ado-repo.sh kind = build_helper sizeBytes = 5890 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

stacks/agenred-rag-api/cloud/provision-ado-repo.shView on unpkg

docs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdfView file

•path = docs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdf kind = high_entropy_blob sizeBytes = 55962 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

docs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdfView on unpkg

dist/prompt-eval/provider.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = copilot-framework@1.3.1 matchedIdentity = npm:Y29waWxvdC1mcmFtZXdvcms:1.3.1 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/prompt-eval/provider.jsView on unpkg