Loading npm security reports…

cxtms@1.9.250: AI-agent control-surface risk | LPM Firewall

registry / cxtms / 1.9.250

cxtms@1.9.250

Schema validation package for CXTMS YAML modules

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consumer project's Claude Code skill control surface. It replaces package-named skill directories and removes several other skill directories.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

Package-authored agent instructions become active in the consumer project without an explicit setup command.

Mechanism

Automatic deletion and copying into .claude/skills

Policy narrative

The npm postinstall hook locates the consumer project, creates project files, and automatically installs three package-controlled Claude Code skills under .claude/skills. Before copying, it recursively deletes matching skill directories and also deletes several pre-existing skill names. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The automatic postinstall hook changes Claude Code skills in the consumer project and removes existing skill directories. This meets the install-time AI-agent control-surface abuse policy despite no observed credential exfiltration.

Evidence

package.jsonscripts/postinstall.js.cx-schema/**.cx-schema/validate.js.claude/skills/cxtms-developer.claude/skills/cxtms-module-builder.claude/skills/cxtms-workflow-builder.claude/skills/cx-build.claude/skills/cx-core

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "cxtms",

3 "version": "1.9.250",

4 "description": "Schema validation package for CXTMS YAML modules",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cxtms": "dist/cli.js",

9 "cx-cli": "dist/cli.js"

10 },

11 "scripts": {

12 "build": "tsc",

13 "prepare": "npm run build",

14 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "test": "vitest run"

16 },

17 "keywords": [

18 "schema",

19 "validation",

20 "yaml",

21 "tms",

22 "cxtms",

23 "module"

24 ],

25 "author": "CXTMS",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/cargoxplorer/cx-schema.git"

30 },

31 "files": [

32 "dist",

33 "schemas",

34 "scripts",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47

dist/cli.jsView file

Lines 1507-1565javascript

1507 }

1508 // Remove deprecated skills if they exist

1509 const deprecatedSkills = ['cx-build', 'cx-core', 'cx-module', 'cx-workflow'];

1510 for (const oldSkill

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

3/**

4 * Postinstall script to create .cx-schema folder in the project root

5 */

6

7const fs = require('fs'

templates/workflow-ftp-tracking.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47