Loading npm security reports…

gm-plugkit@2.0.2538: AI-agent control-surface risk | LPM Firewall

registry / gm-plugkit / 2.0.2538

gm-plugkit@2.0.2538

Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Running the CLI modifies global AI-agent skill directories and project agent instruction files, then starts a downloaded native daemon. The daemon becomes an instruction source agents are told to follow.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs gm-plugkit (including its default CLI path).

Impact

Untrusted remote content can execute natively and steer future agent behavior across projects.

Mechanism

Remote native payload execution plus AI-agent control-surface rewiring.

Policy narrative

The CLI invokes ensureReady, which rewrites project agent instructions and installs package or remotely fetched skills into global agent directories. It then downloads a latest native runner and a matching hash from the same remote release, executes it detached, and injects instructions telling agents to follow daemon-provided imperatives. This combines remotely replaceable native execution with persistent AI-agent control-surface modification.

Rationale

This is a concrete malicious chain, not merely a bootstrapper: it installs broad agent instructions and executes an unpinned remote native payload. Lack of an npm lifecycle hook does not mitigate the user-triggered compromise path.

Evidence

bootstrap.jsbootstrap-shared.jscli.jsSKILL.mdSKILL-agent-memory.md~/.agents/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md<project>/CLAUDE.md

Source & flagged code

6 flagged · loading source

bootstrap-shared.jsView file

5const os = require('os'); L6: const { spawnSync } = require('child_process'); L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');

High

Child Process

Package source references child process execution.

bootstrap-shared.jsView on unpkg · L5

bootstrap.jsView file

7const crypto = require('crypto'); L8: const { spawn, spawnSync } = require('child_process'); L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process'); ... L37: L38: const wrapperDir = __dirname; L39: ... L44: try { L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L46: if (ownPkg && ownPkg.version) { ... L167: const dir = gmToolsDir(); L168: const names = process.platform === 'win32' L169: ? ['agentplug-runner.exe']

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bootstrap.jsView on unpkg · L7

7Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js L7: const crypto = require('crypto'); L8: const { spawn, spawnSync } = require('child_process'); L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process'); ... L37: L38: const wrapperDir = __dirname; L39: ... L44: try { L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L46: if (ownPkg && ownPkg.version) { ... L167: const dir = gmToolsDir(); L168: const names = process.platform === 'win32' L169: ? ['agentplug-runner.exe']

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bootstrap.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = gm-plugkit@2.0.2533 matchedPath = bootstrap.js matchedIdentity = npm:Z20tcGx1Z2tpdA:2.0.2533 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bootstrap.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a88d8c2f80b4568a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = gm-plugkit@2.0.2533 matchedPath = bootstrap.js matchedIdentity = npm:Z20tcGx1Z2tpdA:2.0.2533 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bootstrap.jsView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = gm-plugkit@2.0.2533 matchedPath = cli.js matchedIdentity = npm:Z20tcGx1Z2tpdA:2.0.2533 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg