AI Security Review
scanned 7h ago · by lpm-firewall-aiLPM treats this as warn-only first-party agent extension lifecycle risk. The package has install-time lifecycle behavior that installs a package-provided extension into the user's FIVO CELL home namespace. This is first-party agent-extension lifecycle risk, not confirmed foreign AI-agent control hijack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm install runs package.json postinstall
Impact
Installs or refreshes FIVO CELL extension code for later runtime use; no confirmed credential harvesting, install-time network exfiltration, or foreign control-surface mutation found.
Mechanism
lifecycle copy of package-owned extension into ~/.cell
Rationale
Source inspection confirms an automatic postinstall write into a home-directory agent extension path, but the target is the package's own .cell namespace declared in package.json and the copied extension is package-aligned. Under the supplied policy this fits warn-only first-party agent extension lifecycle risk rather than malicious foreign control-surface hijack.
Evidence
package.json.pi/extensions/fivo.tsdist/cli.jsdist/core/extensions/loader.js~/.cell/agent/extensions/fivo.ts~/.cell/extensions/fivo.ts~/.cell/memory.json~/.cell/memory.db~/.cell/vault.json~/.cell/vibe.md~/.cell/mode.json~/.cell/agent/settings.json
Network endpoints1
api.openai.com/v1/embeddings
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall runs automatically on npm install
- postinstall creates ~/.cell/agent/extensions and copies .pi/extensions/fivo.ts there
- postinstall removes legacy ~/.cell/extensions/fivo.ts if present
- .pi/extensions/fivo.ts stores memory/vault/mode files under ~/.cell and can call OpenAI-compatible embeddings
- dist/cli.js launches an AI coding-agent CLI with PI_CODING_AGENT set
Evidence against
- Lifecycle write is confined to package-owned FIVO CELL configDir .cell
- No postinstall write to Claude/Codex/Cursor/MCP, shell startup, VCS hooks, or OS autostart surfaces found
- Install script does not download remote code or contact the network
- .pi/extensions/fivo.ts network use is runtime/user-configured embedding API, not install-time exfiltration
- Extension loader dynamic loading is package feature for its extension system
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgexamples/extensions/doom-overlay/doom-engine.tsView file
64const nativeRequire = createRequire(doomJsPath);
L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);
L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);
Low
Eval
Package source references a known benign dynamic code generation pattern.
examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64dist/core/extensions/loader.jsView file
52};
L53: const require = createRequire(import.meta.url);
L54: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core/extensions/loader.jsView on unpkg · L52examples/extensions/doom-overlay/doom/build/doom.wasmView file
•path = examples/extensions/doom-overlay/doom/build/doom.wasm
kind = wasm_module
sizeBytes = 380169
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkgexamples/extensions/doom-overlay/doom/build.shView file
•path = examples/extensions/doom-overlay/doom/build.sh
kind = build_helper
sizeBytes = 3366
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
examples/extensions/doom-overlay/doom/build.shView on unpkgdist/modes/interactive/interactive-mode.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = fcell2@1.0.13
matchedIdentity = npm:ZmNlbGwy:1.0.13
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/modes/interactive/interactive-mode.jsView on unpkgFindings
2 Critical1 High6 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/modes/interactive/interactive-mode.js
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm
MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalexamples/extensions/doom-overlay/doom-engine.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings