Loading npm security reports…

greprag@5.74.21: AI-agent control-surface risk | LPM Firewall

registry / greprag / 5.74.21

greprag@5.74.21

GrepRAG — agent memory for Claude Code, Codex, and OpenCode.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall writes GrepRAG skills into detected ~/.claude/skills and ~/.codex/skills. This silently adds package-controlled instructions to foreign AI-agent control surfaces.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install when a Claude Code or Codex home directory exists

Impact

Persistent unconsented control of future agent instruction loading; the injected skill routes use toward GrepRAG services.

Mechanism

postinstall skill-registry injection

Policy narrative

Installing the package invokes its postinstall hook. If ~/.claude or ~/.codex already exists, the hook creates the platform skills directory as needed and copies the bundled greprag skill there, including a new core skill when absent. This is an unconsented install-time mutation of foreign AI-agent instruction registries, causing subsequent agent sessions to load package-controlled guidance and setup flows.

Rationale

The lifecycle hook performs automatic, persistent writes to foreign Claude Code and Codex skill registries, which meets the install-time AI-agent control-surface hijack boundary. Detection-only gating does not provide user consent.

Evidence

package.jsonscripts/postinstall.jsskill/greprag/SKILL.mdskill/greprag~/.claude/skills/greprag~/.codex/skills/greprag

Network endpoints1

api.greprag.com

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/commands/opencode-watch.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/commands/opencode-watch.js: const API_URL_DEFAULT = 'https://api.greprag.com'; fs.writeFileSync(LOCK_FILE, String(process.pid)); fs.writeFileSync(file, String(timeMs)); locateFile: (f) => path.join(path.dirname(require.resolve('sql.js')), f),

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/commands/opencode-watch.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/commands/opencode-watch.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/opencode-watch.jsView on unpkg

scripts/postinstall.jsView file

24name: 'Claude Code', L25: agentDir: path.join(home, '.claude'), L26: skillsTarget: path.join(home, '.claude', 'skills'), L27: docsTarget: path.join(home, '.claude', 'docs'), L28: refreshClaudeDocs: true, ... L31: name: 'Codex', L32: agentDir: path.join(home, '.codex'), L33: skillsTarget: path.join(home, '.codex', 'skills'), L34: docsTarget: path.join(home, '.codex', 'docs'), L35: refreshClaudeDocs: false, ... L39: function copyDir(src, dest) { L40: fs.mkdirSync(dest, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L24

dist/opencode-plugin.bundle.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: tivation(entries, readnativeskillnames(params)); } // src/opencode-plugin.ts var debug_log_path = path7.join(os2.homedir(), ".greprag", "opencode-plugin-debug.log"); var _debuglogready = false; function dloginit() { if (_debuglogready) return; _debuglogready = true; try { fs7.writefilesync(debug_log_path, ""); } catch { } } function dlog(msg) { dloginit(); const line = `[${(/* @__pure__ */ new date()).toisostring()}] [greprag-memory] ${msg} `; try { fs7.appendfilesync(debug_log_path, line); } catch { } } dlog(`module top reached: pid=${process.pid} argv0=${process.argv[0]} distpath=${__filename}`); var api_url = "https: function loadenvfile(filepath

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/opencode-plugin.bundle.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/opencode-plugin.bundle.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/opencode-plugin.bundle.jsView on unpkg

dist/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. '; if (!fs.existssync(dir)) fs.mkdirsync(dir, { recursive: true }); const body = object.entries(existing) .map(([k, v]) => `${k}=${v}`) .join('\n') + '\n'; fs.writefilesync(file, body); } function readenvfile(file) { const out = {}; try { const raw = fs.readfilesync(file, 'utf-8'); for (const line of raw.split(/\r?\n/)) { const trimmed = line.trim(); if (!trimmed || trimmed.startswith('#')) continue; const idx = trimmed.indexof('='); if (idx < 1) continue; let value = trimmed.slice(idx + 1).trim(); if ((value.startswi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/init.jsView on unpkg

dist/commands/watcher-registry.jsView file

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/commands/watcher-registry.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/watcher-registry.jsView on unpkg

dist/ccr-store.jsView file

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/ccr-store.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ccr-store.jsView on unpkg

dist/commands/fix.jsView file

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/commands/fix.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/fix.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "greprag",

3 "version": "5.74.21",

4 "description": "GrepRAG — agent memory for Claude Code, Codex, and OpenCode.",

5 "main": "dist/index.js",

6 "bin": {

7 "greprag": "dist/index.js",

8 "greprag-hook": "dist/hook.js",

9 "greprag-codex-hook": "dist/codex-fast-hook.js"

10 },

11 "scripts": {

12 "build": "rimraf dist && tsc && node scripts/bundle-opencode-plugin.mjs",

13 "clean": "rimraf dist",

14 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "dist/**/*.js",

18 "dist/**/*.json",

19 "skill",

20 "scripts"

21 ],

22 "devDependencies": {

23 "@types/node": "^20.0.0",

24 "@types/sql.js": "^1.4.11",

25 "esbuild": "^0.17.19",

26 "rimraf": "^5.0.0",

27 "typescript": "^5.5.0"

28 },

29 "engines": {

30 "node": ">=18.0.0"

31 },

32 "keywords": [

33 "greprag",

34 "claude",

dist/commands/opencode-watch.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/commands/opencode-watch.js: const API_URL_DEFAULT = 'https://api.greprag.com'; fs.writeFileSync(LOCK_FILE, String(process.pid)); fs.writeFileSync(file, String(timeMs)); locateFile: (f) => path.join(path.dirname(require.resolve('sql.js')), f),

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/commands/opencode-watch.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/commands/opencode-watch.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/opencode-watch.jsView on unpkg

scripts/postinstall.jsView file

Lines 4-44javascript

4// Public UX contract:

5// * `greprag/` — the package's front-door skill. Always installed/refreshed

6// for detected Claude Code and Codex homes so users can type `/greprag`

7// immediately after installing the npm package.

8// * Other bundled skills — refresh-only. If the operator opted in earlier,

9// keep them current; otherwise leave their skill registry alone.

10// * Claude chip-spawn doc — refresh-only, because it is Claude-specific.

11//

12// OpenCode has no slash-skill directory in this package; `greprag init

13// --opencode` installs the plugin.

dist/opencode-plugin.bundle.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: tivation(entries, readnativeskillnames(params)); } // src/opencode-plugin.ts var debug_log_path = path7.join(os2.homedir(), ".greprag", "opencode-plugin-debug.log"); var _debuglogready = false; function dloginit() { if (_debuglogready) return; _debuglogready = true; try { fs7.writefilesync(debug_log_path, ""); } catch { } } function dlog(msg) { dloginit(); const line = `[${(/* @__pure__ */ new date()).toisostring()}] [greprag-memory] ${msg} `; try { fs7.appendfilesync(debug_log_path, line); } catch { } } dlog(`module top reached: pid=${process.pid} argv0=${process.argv[0]} distpath=${__filename}`); var api_url = "https: function loadenvfile(filepath

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/opencode-plugin.bundle.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/opencode-plugin.bundle.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/opencode-plugin.bundle.jsView on unpkg

dist/commands/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. '; if (!fs.existssync(dir)) fs.mkdirsync(dir, { recursive: true }); const body = object.entries(existing) .map(([k, v]) => `${k}=${v}`) .join('\n') + '\n'; fs.writefilesync(file, body); } function readenvfile(file) { const out = {}; try { const raw = fs.readfilesync(file, 'utf-8'); for (const line of raw.split(/\r?\n/)) { const trimmed = line.trim(); if (!trimmed || trimmed.startswith('#')) continue; const idx = trimmed.indexof('='); if (idx < 1) continue; let value = trimmed.slice(idx + 1).trim(); if ((value.startswi

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/init.jsView on unpkg

dist/commands/watcher-registry.jsView file

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/commands/watcher-registry.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/watcher-registry.jsView on unpkg

dist/ccr-store.jsView file

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/ccr-store.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ccr-store.jsView on unpkg

dist/commands/fix.jsView file

•matchType = normalized_sha256 matchedPackage = greprag@5.73.12 matchedPath = dist/commands/fix.js matchedIdentity = npm:Z3JlcHJhZw:5.73.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/fix.jsView on unpkg