registry / idea-gauntlet / 0.5.1

idea-gauntlet@0.5.1

Stress-test product ideas with adversarial agents, synthetic users, and court-style critique.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically creates integrations in detected Claude, Codex, and Cursor control directories. These integrations alter agent instructions and configuration without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Can change behavior and available agent workflows across installed AI coding tools.

Mechanism

automatic writes to foreign AI-agent configuration surfaces

Policy narrative

Installing the package runs a postinstall handler that detects global Claude, Codex, and Cursor directories. It generates and writes agent instruction files, Codex configuration, Cursor rules, and a Claude MCP entry that launches this package's CLI. This mutates foreign AI-agent control surfaces as a side effect of installation rather than through an explicit user setup command.

Rationale

Direct inspection confirms unconsented postinstall mutation of broad foreign AI-agent control surfaces. This meets the blocking policy irrespective of the absence of confirmed credential theft.

Evidence

package.jsondist/postinstall.jsdist/chunk-B7LL55D5.jsAGENTS.md.codex/config.toml.claude/commands/gauntlet-quick.md.cursor/rules/idea-gauntlet-quick.mdcclaude_desktop_config.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

npm postinstall executes dist/postinstall.js.
Postinstall calls globalSetup in install mode without user action.
Setup detects and targets global Claude, Codex, and Cursor configuration directories.
It creates agent instructions/configuration and writes planned actions to those paths.

Evidence against

Existing differing files are left unchanged unless force is set.
No credential exfiltration or remote payload execution was confirmed in the inspected lifecycle path.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 442 KB of source, external domains: api.anthropic.com, api.github.com, api.groq.com, api.openai.com, cdn.jsdelivr.net, fonts.googleapis.com, fonts.gstatic.com, hn.algolia.com, html.duckduckgo.com, news.ycombinator.com, registry.npmjs.org, www.producthunt.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "bin": {

7 "idea-gauntlet": "dist/cli/index.js"

8 },

9 "exports": {

10 "."

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { createInterface } from "readline/promises"; console.log("\n\u26A0 No API key or provider configured."); console.log(" 2) Configure API key now"); baseUrl: options.baseUrl, const rl = (await import("readline/promises")).createInterface({ input: process.stdin, output: process.stdout }); const key = await rl.question("Enter API key: "); baseUrl: options.baseUrl, baseUrl: options.baseUrl,

Findings

2 Critical4 High3 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalAi Agent Control Hijackdist/chunk-B7LL55D5.js

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/cli/index.js

HighEntrypoint Foreign Package Code Overwritedist/chunk-HT6SXACV.js

HighCloud Metadata Accessdist/chunk-A6JBYWQ5.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

dist/chunk-HT6SXACV.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-HT6SXACV.js: import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs"; const res = await fetch("https://registry.npmjs.org/idea-gauntlet/latest", { writeFileSync(cacheFile, JSON.stringify(cacheContent), "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-HT6SXACV.jsView on unpkg

dist/chunk-A6JBYWQ5.jsView file

14// src/search/duckDuckGoProvider.ts L15: var DDG_HTML_URL = "https://html.duckduckgo.com/html/"; L16: var REQUEST_TIMEOUT_MS = 1e4; ... L39: try { L40: const params = new URLSearchParams({ q: query }); L41: const url = `${DDG_HTML_URL}?${params.toString()}`; ... L55: } L56: const html = await response.text(); L57: return parseDuckDuckGoHtml(html, maxResults); ... L250: // src/search/ssrfGuard.ts L251: import { lookup as dnsLookup } from "dns/promises"; L252: function isSafeUrl(url) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-A6JBYWQ5.jsView on unpkg · L14

dist/chunk-B7LL55D5.jsView file

8// src/setup/globalSetup.ts L9: import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync, mkdirSync as mkdirSync3 } from "fs"; L10: import { resolve, dirname as dirname3 } from "path"; ... L44: const home = env["HOME"]; L45: return home ? join(home, ".claude") : null; L46: } ... L50: const home = env["HOME"]; L51: return home ? join(home, ".codex") : null; L52: } ... L67: case "claude": L68: return join(detectedRoot, generatedPath.replace(/^\.claude\//, "")); L69: case "codex":

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/chunk-B7LL55D5.jsView on unpkg · L8

bin → idea-gauntlet

Runtimenode >=18

Artifact485 KB · 39 files1 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

6 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "bin": {

7 "idea-gauntlet": "dist/cli/index.js"

8 },

9 "exports": {

10 "."

: {

11 "import": "./dist/index.js",

12 "types": "./dist/index.d.ts"

13 },

14 "./cli": {

15 "import": "./dist/cli/index.js",

16 "types": "./dist/cli/index.d.ts"

17 }

18 },

19 "files": [

20 "dist",

21 "README.md",

22 "LICENSE"

23 ],

24 "scripts": {

25 "postinstall": "node -e \"try{require('fs').accessSync('dist/postinstall.js');require('child_process').execSync('node dist/postinstall.js',{stdio:'inherit'})}catch(e){process.exit(0)}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L25

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 "build": "tsup src/index.ts src/cli/index.ts src/postinstall.ts --format esm --dts --clean",

27 "dev": "tsx src/cli/index.ts",

28 "start": "node dist/cli/index.js",

29 "test": "vitest run",

30 "test:watch": "vitest",

31 "typecheck": "tsc --noEmit",

32 "lint": "eslint src/ --ext .ts",

33 "lint:fix": "eslint src/ --ext .ts --fix",

34 "format": "prettier --write src/",

35 "prepublishOnly": "npm run build"

36 },

37 "keywords": [

38 "product-discovery",

39 "validation",

40 "adversarial",

41 "startup",

42 "idea"

43 ],

44 "license": "MIT",

45 "author": "Thuong180702 (https://github.com/Thuong180702)",

dist/cli/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli/index.js: import { createInterface } from "readline/promises"; console.log("\n\u26A0 No API key or provider configured."); console.log(" 2) Configure API key now"); baseUrl: options.baseUrl, const rl = (await import("readline/promises")).createInterface({ input: process.stdin, output: process.stdout }); const key = await rl.question("Enter API key: "); baseUrl: options.baseUrl, baseUrl: options.baseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli/index.jsView on unpkg

dist/chunk-HT6SXACV.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-HT6SXACV.js: import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs"; const res = await fetch("https://registry.npmjs.org/idea-gauntlet/latest", { writeFileSync(cacheFile, JSON.stringify(cacheContent), "utf-8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-HT6SXACV.jsView on unpkg

dist/chunk-A6JBYWQ5.jsView file

Lines 1-34javascript

1import {

2 warnIfError

3} from "./chunk-ZGH4NLTD.js";

4

5// src/search/types.ts

6var DEFAULT_SEARCH_CONFIG = {

7 provider: "duckduckgo",

8

dist/chunk-B7LL55D5.jsView file

Lines 1-28javascript

1import {

2 getWorkflow

3} from "./chunk-EMIO7C42.js";

4import {

5 warnIfError

6} from "./chunk-ZGH4NLTD.js";

7

8// src/setup/globalSetup.ts

apiKey:

void

0

,

9 maxResultsPerQuery: 5,

10 maxQueries: 8,

11 timeoutMs: 15e3

12};

13

14// src/search/duckDuckGoProvider.ts

15var DDG_HTML_URL = "https://html.duckduckgo.com/html/";

16var REQUEST_TIMEOUT_MS = 1e4;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-A6JBYWQ5.jsView on unpkg · L14

17var USER_AGENTS = [

18 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",

19 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",

20 "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0",

21 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",

22 "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"

23];

24function rotateUserAgent() {

25 return USER_AGENTS[Math.floor(Math.random() * USER_AGENTS.length)];

26}

27var DuckDuckGoProvider = class {

28 kind = "duckduckgo";

29 lastRequestTime = 0;

30 minDelayMs = 500;

31 async search(query, maxResults = 5) {

32 const now = Date.now();

33 const elapsed = now - this.lastRequestTime;

34 if (elapsed < this.minDelayMs) {

9

import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync, mkdirSync as mkdirSync3 } from "fs";

10import { resolve, dirname as dirname3 } from "path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/chunk-B7LL55D5.jsView on unpkg · L8

11import { fileURLToPath } from "url";

12

13// src/setup/detectTools.ts

14import { existsSync } from "fs";

15

16// src/setup/paths.ts

17import { join } from "path";

18function getIdeaGauntletConfigHome(platform, env, flags) {

19 const flagVal = (typeof flags["config-home"] === "string" ? flags["config-home"] : void 0) ?? (typeof flags.configHome === "string" ? flags.configHome

20 if (flagVal !== void 0 && flagVal.length > 0) return flagVal;

21 const envVal = env["IDEAGAUNTLET_CONFIG_HOME"];

22 if (envVal !== void 0 && envVal.length > 0) return envVal;

23 if (platform === "win32") {

24 const appData = env["APPDATA"];

25 if (appData) return join(appData, "idea-gauntlet");

26 } else if (platform === "darwin") {

27 const home = env["HOME"];

28 if (home) return join(home, "Library", "Application Support", "idea-gauntlet");

:

void

0

)

??

(

typeof

flags.confighome

===

"string"

?

flags.confighome

:

void

0

);