Loading npm security reports…

inplan@0.1.26: AI-agent control-surface risk | LPM Firewall

registry / inplan / 0.1.26

inplan@0.1.26

inplan — a Markdown editor for human ⇄ coding-agent planning. CLI + desktop editor.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates installed AI-agent control surfaces. It installs persistent hooks/extensions that capture agent output and tool activity and can relay it to a cloud document.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing inplan@0.1.26 with lifecycle scripts enabled.

Impact

Persistent cross-agent control-surface modification and potential disclosure of agent messages/tool activity.

Mechanism

Unconsented global agent skill, permission, hook, and extension installation.

Policy narrative

Installation invokes install-skill silently. The CLI detects existing Claude, Codex, and Pi roots, installs agent-facing files, grants Claude permissions, and adds hooks that invoke `inplan relay`. Its Pi extension is auto-loaded, captures assistant messages and tool activity, and relays them to the active local or cloud document. These are persistent mutations of foreign AI-agent control surfaces caused by npm postinstall.

Rationale

Source inspection confirms an unconsented postinstall modifies broad, foreign AI-agent configuration and installs persistent event hooks/extensions. This meets the install-control-surface block policy.

Evidence

package.jsonbin/cli.jsskill/SKILL.md~/.claude/skills/inplan/SKILL.md~/.claude/settings.json~/.codex/skills/inplan/SKILL.md~/.codex/hooks.json~/.pi/agent/skills/inplan/SKILL.md~/.pi/agent/extensions/inplan-relay.ts

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node bin/cli.js install-skill --quiet || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: // src/cli.ts L4: import { execFileSync as execFileSync2, spawn as spawn3, spawnSync } from "child_process"; L5: import { createHash as createHash4 } from "crypto"; L6: import { createRequire } from "module"; L7: import { appendFileSync as appendFileSync2, copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSy... L8: import { homedir as homedir6 } from "os"; ... L87: } else if (!inFence) { L88: const trimmed = line.trimStart(); L89: if (trimmed.startsWith(BLOCK_OPEN)) return offset + (line.

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/renderer/assets/index-CJjtgrEi.jsView file

27292} L27293: fork() { L27294: return new FlatBufferCursor(this.buffer, this.index);

High

Child Process

Package source references child process execution.

app/renderer/assets/index-CJjtgrEi.jsView on unpkg · L27292

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/renderer/assets/index-CJjtgrEi.jsView on unpkg

47701} L47702: if (!pluginMod) pluginMod = await import( L47703: /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/renderer/assets/index-CJjtgrEi.jsView on unpkg · L47701

bin/cli.jsView file

6import { createRequire } from "module"; L7: import { appendFileSync as appendFileSync2, copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readdirSync as readdirSync2, readFileSync as readFileSync9, realpathSy... L8: import { homedir as homedir6 } from "os"; ... L238: // ../core/dist/node.js L239: import { appendFileSync, closeSync, existsSync, openSync, readFileSync, readSync, statSync } from "fs"; L240: import { L241: existsSync as existsSync2, L242: mkdirSync, L243: readdirSync, ... L248: watchFile, L249: writeFileSync L250: } from "fs";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L6

1699const r = spawnSync( L1700: "powershell.exe", L1701: ["-NoProfile", "-NonInteractive", "-Command", "Expand-Archive -LiteralPath $env:INPLAN_ZIP_PATH -DestinationPath $env:INPLAN_DEST_DIR -Force"],

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L1699

3// src/cli.ts L4: import { execFileSync as execFileSync2, spawn as spawn3, spawnSync } from "child_process"; L5: import { createHash as createHash4 } from "crypto"; ... L97: if (openIdx === -1) { L98: return { body: markdown.replace(/\s+$/, ""), comments: [], version: DOC_FORMAT_VERSION }; L99: } ... L114: try { L115: const parsed = jsonText.length === 0 ? [] : JSON.parse(jsonText); L116: if (!Array.isArray(parsed)) { ... L437: function sidecarRoot() { L438: if (process.env.INPLAN_SIDECAR_DIR) return process.env.INPLAN_SIDECAR_DIR; L439: const home = process.env.INPLAN_HOME || join2(homedir(), ".inplan");

High

app/main/index.cjsView file

898} L899: node_child_process.execFile( L900: process.execPath, L901: [cli, ...args], L902: { env: { ...process.env, ...extraEnv, ELECTRON_RUN_AS_NODE: "1" } }, L903: // RUN_AS_NODE last: never overridable ... L910: } L911: const CLOUD_BASE = (process.env.INPLAN_WEB_URL || "https://inplan.ai").replace(/\/$/, ""); L912: const i18n = createI18nController({

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

app/main/index.cjsView on unpkg · L898

2const electron = require("electron"); L3: const node_child_process = require("node:child_process"); L4: const node_fs = require("node:fs"); ... L12: const node_crypto = require("node:crypto"); L13: const node_http = require("node:http"); L14: const APP_ICON_DATA_URL = "data:image/png;base64,[redacted]... L15: var BLOCK_OPEN = "<!--inplan"; ... L232: function sidecarRoot() { L233: if (process.env.INPLAN_SIDECAR_DIR) return process.env.INPLAN_SIDECAR_DIR; L234: const home = process.env.INPLAN_HOME || path.join(os.homedir(), ".inplan"); L235: return path.join(home, "sidecars"); ... L387: fs.mkdirSync(dir, { recursive: true });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/main/index.cjsView on unpkg · L2

Source & flagged code

12 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "inplan",

3 "version": "0.1.26",

4 "description": "inplan — a Markdown editor for human ⇄ coding-agent planning. CLI + desktop editor.",

5 "license": "AGPL-3.0-or-later",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/melly-lgtm/inplan.git"

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

9 },

10 "homepage": "https://inplan.ai",

11 "type": "module",

12 "bin": {

13 "inplan": "bin/cli.js"

14 },

15 "files": [

16 "bin",

17 "app",

18 "skill",

19 "LICENSE"

20 ],

21 "engines": {

22 "node": ">= 22.12.0"

23 },

24 "scripts": {

25 "postinstall": "node bin/cli.js install-skill --quiet || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 },

27 "dependencies": {

28 "electron": "^43.2.0",

29 "@hocuspocus/provider": "^2.15.3",

30 "@supabase/supabase-js": "^2.45.0",

31 "ws": "^8.18.0",

32 "yjs": "^13.6.31"

33 }

34}

35

app/renderer/assets/index-CJjtgrEi.jsView file

27292} L27293: fork() { L27294: return new FlatBufferCursor(this.buffer, this.index);

High

Child Process

Package source references child process execution.

app/renderer/assets/index-CJjtgrEi.jsView on unpkg · L27292

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/renderer/assets/index-CJjtgrEi.jsView on unpkg

47701} L47702: if (!pluginMod) pluginMod = await import( L47703: /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/renderer/assets/index-CJjtgrEi.jsView on unpkg · L47701

bin/cli.jsView file

Lines 1679-1719javascript

1679 if (process.platform === "darwin") return join9(homedir6(), "Library", "Caches", "electron");

1680 return join9(process.env.XDG_CACHE_HOME ??

app/main/index.cjsView file

Lines 1-22javascript

1"use strict";

2const electron = require("electron");

3const node_child_process = require("node:child_process");

4const node_fs