Loading npm security reports…

delimit-cli@4.19.0: Malicious npm security report (Block) | LPM Firewall

registry / delimit-cli / 4.19.0

delimit-cli@4.19.0

The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Session-start and setup paths silently fetch and globally reinstall newer releases, then configure AI-agent integrations. CLI startup also changes an installed AI tool's approval mode and instructions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Running setup, or starting an AI session after its Delimit hook has been installed.

Impact

A future package release can be installed automatically and can rewrite external AI-agent settings to run Delimit-controlled commands and actions without prompting.

Mechanism

Silent self-update followed by broad AI-agent configuration mutation.

Attack narrative

The package includes a postinstall lifecycle and later uses automatic version checks to run a silent global installation of delimit-cli@latest, followed by setup. The session hook repeats that path, making an installed agent integration an automatic update trigger. The setup/configuration code writes into third-party AI-agent configuration; ordinary CLI startup changes Antigravity to auto-edit and injects instructions to start polling and draft or send actions without asking permission. This creates an automatic supply-chain update path combined with broad AI control-surface mutation.

AI rationale

The automatic self-reinstallation chain can execute lifecycle code from a future release and immediately rerun broad agent configuration. The observed configuration injection reduces approval requirements and directs automated external actions.

Evidence

package.jsonbin/delimit-setup.jslib/cross-model-hooks.jsbin/delimit-cli.js~/.gemini/antigravity-cli/settings.json~/.claude/settings.json

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: // Shared prompt gate: false when stdin/stdout is not a TTY, CI is set, L16: // DELIMIT_NON_INTERACTIVE is set, or the user passed --yes. Every prompt ... L19: const SETUP_INTERACTIVE = isInteractive({ yes: process.argv.includes('--yes') || process.argv.includes('-y') }); L20: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L21: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L107: // Self-update check: ensure we're running the latest version (skip if already re-execed) L108: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L109: if (!process.env.DELIMIT_SETUP_UPDATED) { L110: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/delimit-setup.jsView on unpkg · L12

113log(dim(` Updating delimit-cli ${_pkg.version} -> ${latest}...`)); L114: execSync('npm install -g delimit-cli@latest 2>/dev/null', { stdio: 'pipe', timeout: 30000 }); L115: execSync('delimit-cli setup', { stdio: 'inherit', env: { ...process.env, DELIMIT_SETUP_UPDATED: '1' } });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/delimit-setup.jsView on unpkg · L113

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = bin/delimit-setup.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit-setup.jsView on unpkg

10*/ L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/delimit-setup.jsView on unpkg · L10

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: // Shared prompt gate: false when stdin/stdout is not a TTY, CI is set, L16: // DELIMIT_NON_INTERACTIVE is set, or the user passed --yes. Every prompt ... L19: const SETUP_INTERACTIVE = isInteractive({ yes: process.argv.includes('--yes') || process.argv.includes('-y') }); L20: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L21: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L107: // Self-update check: ensure we're running the latest version (skip if already re-execed) L108: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L109: if (!process.env.DELIMIT_SETUP_UPDATED) { L110: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/delimit-setup.jsView on unpkg · L12

lib/proxy-handler.jsView file

7L8: const { spawn } = require('child_process'); L9: const axios = require('axios'); L10: const path = require('path'); ... L12: L13: const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`; L14:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/proxy-handler.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/proxy-handler.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/proxy-handler.jsView on unpkg

bin/delimit-cli.jsView file

63} L64: if (!config.mcpServers) config.mcpServers = {}; L65: if (!config.mcpServers.delimit) { L66: const python = process.platform === 'win32' ? 'python.exe' : 'python3'; ... L71: L72: config.mcpServers.delimit = { L73: command: python, ... L84: } L85: fs.writeFileSync(antigravityConfig, JSON.stringify(config, null, 2)); L86: } ... L476: // --- MCP --- L477: const mcpConfigPath = path.join(homedir, '.mcp.json');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/delimit-cli.jsView on unpkg · L63

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = bin/delimit-cli.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit-cli.jsView on unpkg

lib/cross-model-hooks.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ion migratetonestedformat(hookgroup) { if (hookgroup.hooks && array.isarray(hookgroup.hooks)) { return hookgroup; } const nested = { matcher: hookgroup.matcher || '' }; if (hookgroup.if) nested.if = hookgroup.if; nested.hooks = [{ type: hookgroup.type || 'command', command: hookgroup.command }]; return nested; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/cross-model-hooks.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/cross-model-hooks.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cross-model-hooks.jsView on unpkg

lib/auth-setup.jsView file

11Trigger-reachable persistence chain: manifest.bin -> bin/delimit-cli.js -> lib/auth-setup.js L11: const crypto = require('crypto'); L12: const { execSync } = require('child_process'); L13: const chalk = require('chalk'); ... L16: constructor() { L17: this.configDir = path.join(process.env.HOME, '.delimit'); L18: this.credentialsFile = path.join(this.configDir, 'credentials.enc'); ... L183: console.log(chalk.gray('\n Required scopes for full functionality:')); L184: console.log(chalk.gray(' • repo (Full control of private repositories)')); L185: console.log(chalk.gray(' • workflow (Update GitHub Action workflows)')); ... L281: L282: mcp[server].endpoint = await this.prompt(' Endpoint URL (http://localhost:8080): ', 'http://localhost:8080'); L283: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/auth-setup.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/auth-setup.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth-setup.jsView on unpkg

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/license_core.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 880904 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/license_core.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/agent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/agent.js#virtual:normalized:round1View on unpkg

lib/hooks-installer.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/hooks-installer.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hooks-installer.jsView on unpkg

lib/agent.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/agent.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/agent.jsView on unpkg

lib/api-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/api-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/api-engine.jsView on unpkg

lib/attest-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/attest-mcp.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/attest-mcp.jsView on unpkg

lib/chat-repl.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/chat-repl.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/chat-repl.jsView on unpkg

lib/wrap-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = lib/wrap-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/wrap-engine.jsView on unpkg

bin/delimit.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.18.8 matchedPath = bin/delimit.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.18.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit.jsView on unpkg