Loading npm security reports…

gm-plugkit@2.0.2547: Malicious npm security report (Block) | LPM Firewall

registry / gm-plugkit / 2.0.2547

gm-plugkit@2.0.2547

Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Explicit CLI use bootstraps a remote native daemon and installs remotely sourced agent skills. It also mutates project agent-instruction files so the daemon-controlled workflow is loaded.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs gm-plugkit (for example bun x gm-plugkit spool).

Impact

A mutable remote publisher can replace the native runner or skill instructions, gaining code execution and control over supported agent environments.

Mechanism

Remote binary execution plus cross-agent instruction/control-surface writes.

Attack narrative

On explicit invocation, the package fetches a native runner and its checksum from the same remote release, persists it under ~/.gm-tools, and launches it detached. It also fetches mutable remote skill files into both ~/.agents and ~/.claude, then rewrites project CLAUDE.md and AGENTS.md to load daemon-directed instructions. The bundled skill tells agents to treat daemon-served prose as principal and avoid ordinary summaries, creating a remote-controlled agent workflow.

Rationale

This is concrete remote-code and broad AI-agent control-surface behavior, not merely a package-aligned downloader. No lifecycle hook mitigates the risk because the explicit CLI path performs the full chain.

Evidence

package.jsoncli.jsbootstrap.jsbootstrap-shared.jsSKILL.md~/.gm-tools/agentplug-runner~/.agents/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md

Source & flagged code

6 flagged · loading source

bootstrap-shared.jsView file

5const os = require('os'); L6: const { spawnSync } = require('child_process'); L7: const { pidAlive, sha256OfFileSync } = require('./gm-process');

High

Child Process

Package source references child process execution.

bootstrap-shared.jsView on unpkg · L5

bootstrap.jsView file

7const crypto = require('crypto'); L8: const { spawn, spawnSync } = require('child_process'); L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process'); ... L37: L38: const wrapperDir = __dirname; L39: ... L44: try { L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L46: if (ownPkg && ownPkg.version) { ... L167: const dir = gmToolsDir(); L168: const names = process.platform === 'win32' L169: ? ['agentplug-runner.exe']

Critical

Download Execute

Source downloads or fetches remote code and executes it.

bootstrap.jsView on unpkg · L7

7Trigger-reachable chain: manifest.main -> index.js -> bootstrap.js L7: const crypto = require('crypto'); L8: const { spawn, spawnSync } = require('child_process'); L9: const { sha256OfFile, sha256OfFileSync } = require('./gm-process'); ... L37: L38: const wrapperDir = __dirname; L39: ... L44: try { L45: const ownPkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')); L46: if (ownPkg && ownPkg.version) { ... L167: const dir = gmToolsDir(); L168: const names = process.platform === 'win32' L169: ? ['agentplug-runner.exe']

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bootstrap.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = gm-plugkit@2.0.2542 matchedPath = bootstrap.js matchedIdentity = npm:Z20tcGx1Z2tpdA:2.0.2542 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bootstrap.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a88d8c2f80b4568a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = gm-plugkit@2.0.2542 matchedPath = bootstrap.js matchedIdentity = npm:Z20tcGx1Z2tpdA:2.0.2542 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bootstrap.jsView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = gm-plugkit@2.0.2542 matchedPath = cli.js matchedIdentity = npm:Z20tcGx1Z2tpdA:2.0.2542 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg