registry / AI-agent capability abuse / delimit-cli / 4.19.11

delimit-cli@4.19.11

The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

AI Security Review

scanned 29d ago · by lpm-firewall-ai

The source supports an explicit-user-command AI-agent configuration capability, not covert installation-time compromise or credential exfiltration. The persistent hooks justify a warning under the requested policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs delimit setup.

Impact

This grants the package persistent influence over configured AI-assistant and commit workflows after explicit setup.

Mechanism

Setup detects AI tools and writes configuration, including a Codex pre-commit hook that runs npx delimit-cli.

AI rationale

Evidence

~/.claude/settings.json~/.codex/instructions.md~/.codex/config.json

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package has a postinstall lifecycle hook.
The explicit setup command loads and runs the setup module.
Setup detects installed AI assistants and installs hooks by default outside interactive prompting.
Codex hook setup writes global instruction and hook configuration files that invoke the package command.

Evidence against

The lifecycle hook only prints guidance unless telemetry is explicitly enabled.
The AI-assistant changes are reached through the user-invoked setup command, not automatically during installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 888 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.lemonsqueezy.com, api.meta.ai, api.openai.com, api.x.ai, app.delimit.ai, delimit.ai, generativelanguage.googleapis.com, github.com, img.shields.io, jsonfeed.org, python.org, registry.npmjs.org, us-central1-aiplatform.googleapis.com

Source & flagged code

26 flagged

package.jsonView file

Lines 146-186json

146 "gateway/tasks/check_policy_v2.py",

147 "gateway/tasks/check_policy_v3.py",

148 "gateway/tasks/explain_diff.py",

149 "gateway/tasks/explain_diff_v2.py",

150 "gateway/tasks/validate_api.py",

151 "gateway/tasks/validate_api_v2.py",

152 "gateway/tasks/validate_api_v3.py",

153 "scripts/postinstall.js",

154 "scripts/muse_mcp.py",

155 "server.json",

156 "README.md",

157 "LICENSE",

158 "CHANGELOG.md",

159 "gateway/ai/session_continuity.py"

160 ],

161 "bin": {

162 "delimit": "./bin/delimit-cli.js",

163 "delimit-cli": "./bin/delimit-cli.js"

164 },

165 "scripts": {

166 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L166

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L166

167 "sync-gateway": "bash scripts/sync-gateway.sh",

168 "prepublishOnly": "node scripts/clean-tree-guard.js && bash scripts/publish-ci-guard.sh && bash scripts/check-bundle-classification.sh && bash scripts/gateway-clean-guard.sh && npm run sync-gateway && bash scripts/build-proprietary-core.sh license_core && bash scripts/build-proprietary-core.sh deliberation && bash scripts/security-check.sh && bash scripts/check-bundle-parity.sh",

169 "version": "node scripts/sync-version-sources.js",

170 "test": "node scripts/test-with-config-guard.js",

171 "test:raw": "node --test tests/clean-tree-guard.test.js tests/_config-sentinel.test.js tests/setup-onboarding.test.js tests/setup-matrix.test.js tests/setup-no-clobber.test.js tests/setup-env-preservation.test.js tests/config-export-import.test.js tests/cross-model-hooks.test.js tests/golden-path.test.js tests/v420-features.test.js tests/v43-wrap-engine.test.js tests/v43-trust-page-engine.test.js tests/v43-ai-sbom-engine.test.js tests/attest-mcp.test.js tests/delimit-home.test.js tests/led5658-cli-remember-isolation.test.js tests/led5658-python-js-home-parity.test.js tests/postinstall-hard ...

172 },

173 "keywords": [

174 "openapi",

175 "swagger",

176 "api",

177 "breaking-changes",

178 "semver",

179 "lint",

180 "linter",

181 "api-governance",

182 "api-contracts",

183 "ci-cd",

184 "github-actions",

185 "migration",

186 "diff",

Long lines were clipped for display.

bin/delimit-setup.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * delimit setup — Install Delimit MCP governance tools into Claude Code.

4 *

5 * What it does:

6 * 1. Creates ~/.delimit/ directory with the MCP server + core engine

7 * 2. Adds "delimit" to Claude Code's MCP config (~/.mcp.json or .mcp.json)

8 * 3. Installs default agents into ~/.claude/agents/

9 * 4. Prints next steps

10 */

11const

lib/proxy-handler.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

3/**

4 * Delimit Proxy Handler - Intercepts AI tool commands

5 * This module wraps AI tools (claude, gemini, codex) with governance

6 */

8const { spawn } = require('child_process');

9const

bin/delimit-cli.jsView file

Lines 52-92javascript

52 try { return require('../package.json').version; } catch { return 'unknown'; }

53})();

55const continuityContext = resolveContinuityContext();

lib/cross-model-hooks.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ion migratetonestedformat(hookgroup) { if (hookgroup.hooks && array.isarray(hookgroup.hooks)) { return hookgroup; } const nested = { matcher: hookgroup.matcher || '' }; if (hookgroup.if) nested.if = hookgroup.if; nested.hooks = [{ type: hookgroup.type || 'command', command: hookgroup.command }]; return nested; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/cross-model-hooks.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/cross-model-hooks.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cross-model-hooks.jsView on unpkg

lib/auth-setup.jsView file

11Trigger-reachable persistence chain: manifest.bin -> bin/delimit-cli.js -> lib/auth-setup.js L11: const crypto = require('crypto'); L12: const { execSync } = require('child_process'); L13: const chalk = require('chalk'); ... L16: constructor() { L17: this.configDir = path.join(process.env.HOME, '.delimit'); L18: this.credentialsFile = path.join(this.configDir, 'credentials.enc'); ... L183: console.log(chalk.gray('\n Required scopes for full functionality:')); L184: console.log(chalk.gray(' • repo (Full control of private repositories)')); L185: console.log(chalk.gray(' • workflow (Update GitHub Action workflows)')); ... L281: L282: mcp[server].endpoint = await this.prompt(' Endpoint URL (http://localhost:8080): ', 'http://localhost:8080'); L283: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/auth-setup.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/auth-setup.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth-setup.jsView on unpkg

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 2646312 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/agent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/agent.js#virtual:normalized:round1View on unpkg

lib/hooks-installer.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/hooks-installer.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hooks-installer.jsView on unpkg

lib/agent.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/agent.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/agent.jsView on unpkg

lib/api-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/api-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/api-engine.jsView on unpkg

lib/attest-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/attest-mcp.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/attest-mcp.jsView on unpkg

lib/wrap-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/wrap-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/wrap-engine.jsView on unpkg

bin/delimit.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = bin/delimit.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit.jsView on unpkg

lib/session-shell.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/session-shell.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/session-shell.jsView on unpkg

lib/delimit-template.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/delimit-template.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/delimit-template.jsView on unpkg

lib/platform-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/platform-adapters.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/platform-adapters.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

Findings

1 Critical21 High8 Medium5 Low

CriticalAi Agent Control Hijackbin/delimit-cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/delimit-setup.js

HighShell

HighSame File Env Network Executionlib/proxy-handler.js

HighSandbox Evasion Gated Capabilitybin/delimit-setup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/cross-model-hooks.js

HighTrigger Reachable Persistencelib/auth-setup.js

HighRuntime Package Installbin/delimit-setup.js

HighSemantic Analysis Limitedlib/agent.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/auth-setup.js

Affected versions and remediation

This report applies to delimit-cli@4.19.11.

See all versions of delimit-cli for other recorded verdicts.

Review the evidence and your use of delimit-cli@4.19.11 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-24 00:04:59.210Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code