idea-gauntlet@0.5.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

idea-gauntlet@0.5.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { createInterface } from "readline/promises"; console.log("\n\u26A0 No API key or provider configured."); console.log(" 2) Configure API key now"); baseUrl: options.baseUrl, const rl = (await import("readline/promises")).createInterface({ input: process.stdin, output: process.stdout }); const key = await rl.question("Enter API key: "); baseUrl: options.baseUrl, baseUrl: options.baseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.js: import { mkdirSync, writeFileSync, existsSync as existsSync2 } from "fs"; if (!existsSync2(ideaFile)) writeFileSync(ideaFile, IDEA_TEMPLATE, "utf-8"); if (!existsSync2(configFile)) writeFileSync(configFile, CONFIG_TEMPLATE, "utf-8"); writeFileSync(resolve2(dir, "ideas", "my-idea.md"), IDEA_TEMPLATE, "utf-8"); writeFileSync(resolve2(dir, "config.json"), CONFIG_TEMPLATE, "utf-8"); const res = await fetch("https://html.duckduckgo.com/html/?q=test", { import { readFileSync as readFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs"; writeFileSync2(filepath, generateHtmlReport2(r.report),

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/index.jsView on unpkg

dist/chunk-A6JBYWQ5.jsView file

14// src/search/duckDuckGoProvider.ts L15: var DDG_HTML_URL = "https://html.duckduckgo.com/html/"; L16: var REQUEST_TIMEOUT_MS = 1e4; ... L39: try { L40: const params = new URLSearchParams({ q: query }); L41: const url = `${DDG_HTML_URL}?${params.toString()}`; ... L55: } L56: const html = await response.text(); L57: return parseDuckDuckGoHtml(html, maxResults); ... L250: // src/search/ssrfGuard.ts L251: import { lookup as dnsLookup } from "dns/promises"; L252: function isSafeUrl(url) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-A6JBYWQ5.jsView on unpkg · L14

dist/chunk-B7LL55D5.jsView file

8// src/setup/globalSetup.ts L9: import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync, mkdirSync as mkdirSync3 } from "fs"; L10: import { resolve, dirname as dirname3 } from "path"; ... L44: const home = env["HOME"]; L45: return home ? join(home, ".claude") : null; L46: } ... L50: const home = env["HOME"]; L51: return home ? join(home, ".codex") : null; L52: } ... L67: case "claude": L68: return join(detectedRoot, generatedPath.replace(/^\.claude\//, "")); L69: case "codex":

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/chunk-B7LL55D5.jsView on unpkg · L8

Source & flagged code

6 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "bin": {

7 "idea-gauntlet": "dist/cli/index.js"

8 },

9 "exports": {

10 ".": {

11 "import": "./dist/index.js",

12 "types": "./dist/index.d.ts"

13 },

14 "./cli": {

15 "import": "./dist/cli/index.js",

16 "types": "./dist/cli/index.d.ts"

17 }

18 },

19 "files": [

20 "dist",

21 "README.md",

22 "LICENSE"

23 ],

24 "scripts": {

25 "postinstall": "node -e \"try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L25

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 "build": "tsup src/index.ts src/cli/index.ts src/postinstall.ts --format esm --dts --clean",

27 "dev": "tsx src/cli/index.ts",

28 "start": "node dist/cli/index.js",

29 "test": "vitest run",

30 "test:watch": "vitest",

31 "typecheck": "tsc --noEmit",

32 "lint": "eslint src/ --ext .ts",

33 "lint:fix": "eslint src/ --ext .ts --fix",

34 "format": "prettier --write src/",

35 "prepublishOnly": "npm run build"

36 },

37 "keywords": [

38 "product-discovery",

39 "validation",

40 "adversarial",

41 "startup",

42 "idea"

43 ],

44 "license": "MIT",

45 "author": "Thuong180702 (https://github.com/Thuong180702)",

dist/cli/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { createInterface } from "readline/promises"; console.log("\n\u26A0 No API key or provider configured."); console.log(" 2) Configure API key now"); baseUrl: options.baseUrl, const rl = (await import("readline/promises")).createInterface({ input: process.stdin, output: process.stdout }); const key = await rl.question("Enter API key: "); baseUrl: options.baseUrl, baseUrl: options.baseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.js: import { mkdirSync, writeFileSync, existsSync as existsSync2 } from "fs"; if (!existsSync2(ideaFile)) writeFileSync(ideaFile, IDEA_TEMPLATE, "utf-8"); if (!existsSync2(configFile)) writeFileSync(configFile, CONFIG_TEMPLATE, "utf-8"); writeFileSync(resolve2(dir, "ideas", "my-idea.md"), IDEA_TEMPLATE, "utf-8"); writeFileSync(resolve2(dir, "config.json"), CONFIG_TEMPLATE, "utf-8"); const res = await fetch("https://html.duckduckgo.com/html/?q=test", { import { readFileSync as readFileSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs"; writeFileSync2(filepath, generateHtmlReport2(r.report),

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/index.jsView on unpkg

dist/chunk-A6JBYWQ5.jsView file

Lines 1-34javascript

1import {

2 warnIfError

3} from "./chunk-ZGH4NLTD.js";

4

5// src/search/types.ts

6var DEFAULT_SEARCH_CONFIG = {

7 provider: "duckduckgo",

8

dist/chunk-B7LL55D5.jsView file

Lines 1-28javascript

1import {

2 getWorkflow

3} from "./chunk-EMIO7C42.js";

4import {

5 warnIfError

6} from "./chunk-ZGH4NLTD.js";

7

8// src/setup/globalSetup.ts