registry / AI-agent control-surface risk / inplan
inplan
inplan — a Markdown editor for human ⇄ coding-agent planning. CLI + desktop editor.
This report shows the evidence for inplan@0.2.1. 3 of 5 known versions are blocked or flagged. The newest version, 0.3.0, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource confirms a concrete postinstall chain that persists hooks/extensions across third-party AI-agent environments and relays agent activity. This meets the block policy regardless of the opt-out environment variable.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install of inplan@0.2.1 when an agent root exists
Impact
Persistent agent behavior changes and disclosure of assistant output/tool activity to Inplan's document channel.
Mechanism
install-time foreign AI-agent skill, permission, hook, and extension injection with transcript relay
Policy narrative
Installing the package runs install-skill automatically and ignores failures. Where agent directories already exist, it plants skills, modifies Claude permissions, registers Claude/Codex lifecycle hooks, and installs an auto-loaded Pi extension. Those hooks read agent messages, transcript paths, and tool input/activity, then relay the derived text to an active Inplan document; cloud documents use the package's remote backend. This is unconsented install-time mutation of broad, foreign AI-agent control surfaces.
AI rationale
Source confirms a concrete postinstall chain that persists hooks/extensions across third-party AI-agent environments and relays agent activity. This meets the block policy regardless of the opt-out environment variable.
Evidence
package.jsonbin/cli.jsskill/SKILL.md~/.claude/skills/inplan/SKILL.md~/.claude/settings.json~/.codex/skills/inplan/SKILL.md~/.codex/hooks.json~/.pi/agent/skills/inplan/SKILL.md~/.pi/agent/extensions/inplan-relay.ts
Network endpoints2
inplan.aiwss://inplan-collab.fly.dev
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- postinstall silently invokes install-skill.
- It writes skills into existing Claude, Pi, and Codex agent directories.
- It adds Claude auto-approval rules and relay hooks.
- It installs a Pi auto-loaded extension that forwards assistant text and tool activity.
- Relay handlers read agent transcript paths and forward messages to local or cloud documents.
Evidence against
- Installation skips absent agent roots and supports INPLAN_NO_SKILL_INSTALL opt-out.
- No standalone credential-harvesting or unrelated destructive payload was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/cli.js install-skill --quiet || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg3scripts.postinstall = node bin/cli.js install-skill --quiet || true
Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution.
L3: // src/cli.ts
L4: import { execFileSync as execFileSync2, spawn as spawn3, spawnSync } from "child_process";
L5: import { createHash as createHash4, randomBytes } from "crypto";
L6: import { createRequire } from "module";
L7: import { appendFileSync as appendFileSync3, copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync2, readFileSync as readFileSync11, realpat...
L8: import { homedir as homedir7 } from "os";
...
L87: } else if (!inFence) {
L88: const trimmed = line.trimStart();
L89: if (trimmed.startsWith(BLOCK_OPEN)) return of
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L3•scripts.postinstall = node bin/cli.js install-skill --quiet || true
Findings
1 Critical9 High5 Medium6 Low
CriticalAi Agent Control Hijackbin/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processapp/renderer/assets/index-Cv94hl_t.js
HighShellbin/cli.js
HighSame File Env Network Executionbin/cli.js
HighEntrypoint Foreign Package Code Overwritebin/cli.js
HighUnverified Remote Native Payload Installpackage.json
HighExternal Ai Agent Control Surface Mutationbin/cli.js
HighSemantic Analysis Limitedapp/renderer/assets/index-Cv94hl_t.js
HighKnown Malware Source Similarityapp/main/index.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
Affected versions and remediation
This report applies to inplan@0.2.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing inplan@0.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.