Loading npm security reports…

cxtms@1.9.256: AI-agent control-surface risk | LPM Firewall

registry / cxtms / 1.9.256

cxtms@1.9.256

Schema validation package for CXTMS YAML modules

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install runs a postinstall script that walks to a parent project and writes Claude Code skills into that project's .claude/skills directory, replacing existing folders with the same names. This happens without a setup command and is not limited to a first-party package-owned extension path.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of cxtms, which runs the postinstall script automatically.

Impact

Claude Code in the consuming project can load third-party skills and drop deprecated skill folders without the user opting in.

Mechanism

unconsented postinstall write into Claude Code project skills

Policy narrative

When a consumer installs cxtms from npm, postinstall walks up from the working directory until it finds a package.json that is not named @cxtms/cx-schema. It then copies packaged Claude Code skills into that project's .claude/skills directory, replacing any existing folders with those names and deleting deprecated skill names. Claude Code loads those skills as project agent instructions without a setup command. The published package name is cxtms, so the @cxtms/cx-schema skip does not prevent this on a normal install.

AI rationale

The postinstall hook writes Claude Code skills into the consumer project's .claude/skills directory without a user command, which is an unconsented install-time mutation of a foreign agent control surface. That is a publish block even though the skill files themselves look like CXTMS product docs.

Evidence

package.jsonscripts/postinstall.js.claude/skills/cxtms-developer.claude/skills/cxtms-module-builder

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

3/**

4 * Postinstall script to create .cx-schema folder in the project root

5 */

6

7const fs = require('fs'

templates/workflow-ftp-tracking.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47