Loading npm security reports…

cxtms@1.9.243: AI-agent control-surface risk | LPM Firewall

registry / cxtms / 1.9.243

cxtms@1.9.243

Schema validation package for CXTMS YAML modules

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall walks to the consumer project and copies Claude Code skills into .claude/skills. That happens without an explicit user setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of cxtms, which runs the postinstall script.

Impact

The consumer Claude Code agent can load vendor skills that instruct it to generate, validate, and deploy CXTMS modules.

Mechanism

unconsented install-time write into Claude Code skills

Policy narrative

Installing cxtms runs postinstall, which walks up from the current working directory to a consumer package.json and copies three Claude Code skills into that project's .claude/skills folder. The skip check looks for package name @cxtms/cx-schema, so a cxtms install is not skipped. After install, Claude Code can load those skills and follow their instructions to generate, validate, and deploy CXTMS YAML. That is an unconsented change to a third-party AI agent control surface.

AI rationale

The postinstall hook writes Claude Code skills into the installing project's .claude/skills directory without a user command. That is unconsented mutation of a foreign AI-agent control surface, so this release should be blocked.

Evidence

package.jsonscripts/postinstall.js.claude/skills/cxtms-developer.claude/skills/cxtms-module-builder.claude/skills/cxtms-workflow-builder.cx-schema.cx-schema/validate.js

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62