registry / fjall / 2.33.0

fjall@2.33.0

Fjall CLI

AI Security Review

scanned 12h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The CLI can explicitly install persistent AI-agent session hooks. Those hooks run Fjall status on subsequent Claude Code and Codex sessions.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `fjall agent install-hooks`, then starts an agent session.

Impact

Persistent agent-session command execution; no unconsented install-time mutation or exfiltration chain confirmed.

Mechanism

Writes managed Claude Code and Codex pre-session command hooks.

Rationale

Source inspection confirms explicit, persistent AI-agent control-surface writes, which warrants a warning under the stated policy. The absence of lifecycle hooks and the explicit user command rule out a publish block.

Evidence

package.jsonbin/fjall.jsbin/fjall.bundle.js~/.claude/settings.json~/.codex/hooks.json~/.claude/skills/fjall/SKILL.md~/.fjall/hook-opt-out

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/fjall.bundle.js` exposes explicit `fjall agent install-hooks`.
It writes a Claude Code hook to `~/.claude/settings.json`.
It writes a Codex pre-session hook to `~/.codex/hooks.json`.
Both hooks execute `fjall status --agent --budget minimal` each agent session.
`agent install-skill` writes a managed `SKILL.md` under `~/.claude/skills/fjall` by default.

Evidence against

`package.json` declares no `preinstall`, `install`, `postinstall`, or `prepare` hook.
`bin/fjall.js` runs only when the user invokes `fjall`.
Hook installation is an explicit subcommand and supports opt-out/removal.
No credential-exfiltration endpoint or hidden payload execution was confirmed.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

Source & flagged code

5 flagged

bin/assets/generators/organisation/generator.jsView file

Lines 1-35javascript

1import { createRequire as __fjcreateRequire } from "module";

2const require = __fjcreateRequire(import.meta.url);

4var Cv=Object.defineProperty;var he=(e,r)=>{for(var n in r)Cv(e,n,{get:r[n],enumerable:!0})};import{join as JE}from"path";import mo from"node:fs"

5 "&": "&"

6 , "<": "<"

7 , ">": ">"

8 , '"': """

9 , "'": "'"

10 }

11 , _MATCH_HTML = /[&<>'"]/g;

12function encode_char(c) {

13 return _ENCODE_HTML_RULES[c] || c;

14};

15`;ee.escapeXML=function(e){return e==null?"":String(e).replace(zv,Mv)};function bd(){return Function.prototype.toString.call(this)+`;

16`+jv}try{typeof Object.defineProperty=="function"?Object.defineProperty(ee.escapeXML,"toString",{value:bd}):ee.escapeXML.toString=bd}catch{console.warn("Unable to set escapeXML.toString (is the Function prototype frozen?)")}ee.shallowCopy=function(e,r){if(r

17`),s=Math.max(o-3,0),c=Math.min(i.length,o+3),d=t(n),u=i.slice(s,c).map(function(m,g){let v=g+s+1;return(v==o?" >> ":" ")+v+"| "+m}).join(`

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

18`);throw e.path=d,e.message=(d||"ejs")+":"+o+`

19`+u+`

21`+e.message,e}function Ad(e){return e.replace(/;(\s*$)/,"$1")}k.compile=function(r,n){let o;return n&&n.scope&&(console.warn("`scope` option is deprecated and will be removed in future EJS"),n.context||(n.context=n.scope),delete n.scope),o=new j(r,n),o.compile()};k.render=function(e,r,n){let o=r||w.createNullProtoObjWherePossible(),t=n||w.createNullProtoObjWherePossible();return arguments.length==2&&w.shallowCopyFromList(t,o,xd),Wt(t,e)(o)};k.renderFile=function(){let e=Array.prototype.slice.call(arguments),r=e.shift(),n,o={filename:r},t,i;return typeof arguments[arguments.length-1]=="function ...

22 function __append(s) { if (s !== undefined && s !== null) __output += s }

23`,n.outputFunctionName){if(!lo.test(n.outputFunctionName))throw new Error("outputFunctionName is not a valid JS identifier.");o+=` ${Wr} `+n.outputFunctionName+` = __append;

24`}if(n.localsName&&!lo.test(n.localsName))throw new Error("localsName is not a valid JS identifier.");if(n.destructuredLocals&&n.destructuredLocals.length){let u=` ${Wr} __locals = (`+n.localsName+` || {}),

25`;for(let m=0;m<n.destructuredLocals.length;m++){let g=n.destructuredLocals[m];if(!lo.test(g))throw new Error("destructuredLocals["+m+"] is not a valid JS identifier.");m

26 `),u+=g+" = __locals."+g}o+=u+`;

27`}n._with!==!1&&(o+=" with ("+n.localsName+` || {}) {

28`,t+=` }

29`),t+=` return __output;

30`,this.source=o+this.source+t}n.compileDebug?e=`${Wr} __line = 1

31 , __lines = `+JSON.stringify(this.templateText)+`

32 , __filename = `+c+`;

33try {

34`+this.source+`} catch (e) {

35 rethrow(e, __lines, __filename, __line, escapeFn);

Long lines were clipped for display.

bin/fjall.bundle.jsView file

•path = bin/fjall.bundle.js kind = oversized_source_file sizeBytes = 3792875 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/fjall.bundle.jsView on unpkg

•path = bin/fjall.bundle.js kind = oversized_cli_entrypoint sizeBytes = 3792875 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/fjall.bundle.jsView on unpkg

bin/assets/generators/application/generator.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fjall@2.29.0 matchedIdentity = npm:ZmphbGw:2.29.0 similarity = 0.471 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/assets/generators/application/generator.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/assets/generators/organisation/generator.jsView file

15`;ee.escapeXML=function(e){return e==null?"":String(e).replace(zv,Mv)};function bd(){return Function.prototype.toString.call(this)+`; L16: `+jv}try{typeof Object.defineProperty=="function"?Object.defineProperty(ee.escapeXML,"toString",{value:bd}):ee.escapeXML.toString=bd}catch{console.warn("Unable to set escapeXML.toS... L17: `),s=Math.max(o-3,0),c=Math.min(i.length,o+3),d=t(n),u=i.slice(s,c).map(function(m,g){let v=g+s+1;return(v==o?" >> ":" ")+v+"| "+m}).join(` ... L42: `,u.message+=`If the above error is not helpful, you may want to try EJS-Lint: L43: `,u.message+="https://github.com/RyanZim/EJS-Lint",n.async||(u.message+=` L44: `,u.message+="Or, if you meant to create an async function, pass `async: true` as an option.")),u}let d=function(m){let g=function(_,A){let U=w.shallowC

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

Findings

1 Critical2 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/assets/generators/application/generator.js

HighObfuscated Payload Loaderbin/assets/generators/organisation/generator.js

HighOversized Source Filebin/fjall.bundle.js

MediumDynamic Require

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointbin/fjall.bundle.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbin/assets/generators/organisation/generator.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License