Loading npm security reports…

inplan@0.2.0: AI-agent control-surface risk | LPM Firewall

registry / inplan / 0.2.0

inplan@0.2.0

inplan — a Markdown editor for human ⇄ coding-agent planning. CLI + desktop editor.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates pre-existing Claude, Codex, and Pi agent control surfaces without an explicit user command. It adds skills, approval rules, event hooks, and an auto-loaded relay extension.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Persistent execution in agent lifecycle hooks and forwarding of agent messages/tool activity to inplan documents.

Mechanism

foreign AI-agent configuration mutation and activity relay installation

Policy narrative

On installation, the package runs install-skill automatically. When agent directories already exist, it writes skills into Claude, Codex, and Pi locations; changes Claude approval settings; registers Claude/Codex Stop and PostToolUse commands; and drops a Pi extension that auto-loads on every Pi run. The installed relay captures assistant text and tool activity for delivery to an inplan document, which may use the package's cloud backend. The default postinstall is quiet and only offers an environment-variable opt-out.

Rationale

This is a concrete, unconsented postinstall mutation of foreign AI-agent control surfaces with persistent hooks and relay behavior. The existing-directory guard does not make the installation user-invoked or consented.

Evidence

package.jsonbin/cli.js~/.claude/skills/inplan/SKILL.md~/.claude/settings.json~/.codex/skills/inplan/SKILL.md~/.codex/hooks.json~/.pi/agent/skills/inplan/SKILL.md~/.pi/agent/extensions/inplan-relay.ts

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node bin/cli.js install-skill --quiet || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: // src/cli.ts L4: import { execFileSync as execFileSync2, spawn as spawn3, spawnSync } from "child_process"; L5: import { createHash as createHash4, randomBytes } from "crypto"; L6: import { createRequire } from "module"; L7: import { appendFileSync as appendFileSync3, copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync2, readFileSync as readFileSync11, realpat... L8: import { homedir as homedir7 } from "os"; ... L87: } else if (!inFence) { L88: const trimmed = line.trimStart(); L89: if (trimmed.startsWith(BLOCK_OPEN)) return of

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/renderer/assets/index-Cv94hl_t.jsView file

27324} L27325: fork() { L27326: return new FlatBufferCursor(this.buffer, this.index);

High

Child Process

Package source references child process execution.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg · L27324

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg

48331} L48332: if (!pluginMod) pluginMod = await import( L48333: /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg · L48331

bin/cli.jsView file

6import { createRequire } from "module"; L7: import { appendFileSync as appendFileSync3, copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync2, readFileSync as readFileSync11, realpat... L8: import { homedir as homedir7 } from "os"; ... L244: // ../core/dist/node.js L245: import { appendFileSync, closeSync, existsSync, openSync, readFileSync, readSync, statSync } from "fs"; L246: import { L247: existsSync as existsSync2, L248: mkdirSync, L249: readdirSync, ... L257: watchFile, L258: writeFileSync L259: } from "fs";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L6

2539const r = spawnSync( L2540: "powershell.exe", L2541: ["-NoProfile", "-NonInteractive", "-Command", "Expand-Archive -LiteralPath $env:INPLAN_ZIP_PATH -DestinationPath $env:INPLAN_DEST_DIR -Force"],

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L2539

1639// src/update.ts L1640: import { spawn as spawn2 } from "child_process"; L1641: var UPDATE_PKG = process.env.INPLAN_PKG || "inplan"; L1642: function compareVersions(a, b) { ... L1654: try { L1655: const res = await fetch(`https://registry.npmjs.org/${pkg.replace("/", "%2F")}/latest`, { L1656: headers: { accept: "application/json" },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L1639

app/main/index.cjsView file

2const electron = require("electron"); L3: const node_child_process = require("node:child_process"); L4: const node_crypto = require("node:crypto"); ... L12: const os = require("os"); L13: const node_http = require("node:http"); L14: const APP_ICON_DATA_URL = "data:image/png;base64,[redacted]... L15: var BLOCK_OPEN = "<!--inplan"; ... L436: function sidecarRoot() { L437: if (process.env.INPLAN_SIDECAR_DIR) return process.env.INPLAN_SIDECAR_DIR; L438: const home = process.env.INPLAN_HOME || path.join(os.homedir(), ".inplan"); L439: return path.join(home, "sidecars"); ... L591: fs.mkdirSync(dir, { recursive: true });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/main/index.cjsView on unpkg · L2

Source & flagged code

12 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "inplan",

3 "version": "0.2.0",

4 "description": "inplan — a Markdown editor for human ⇄ coding-agent planning. CLI + desktop editor.",

5 "license": "AGPL-3.0-or-later",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/melly-lgtm/inplan.git"

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

9 },

10 "homepage": "https://inplan.ai",

11 "type": "module",

12 "bin": {

13 "inplan": "bin/cli.js"

14 },

15 "files": [

16 "bin",

17 "app",

18 "skill",

19 "LICENSE"

20 ],

21 "engines": {

22 "node": ">= 22.12.0"

23 },

24 "scripts": {

25 "postinstall": "node bin/cli.js install-skill --quiet || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 },

27 "dependencies": {

28 "electron": "^43.4.1",

29 "@hocuspocus/provider": "^2.15.3",

30 "@supabase/supabase-js": "^2.45.0",

31 "ws": "^8.18.0",

32 "yjs": "^13.6.31"

33 }

34}

35

app/renderer/assets/index-Cv94hl_t.jsView file

27324} L27325: fork() { L27326: return new FlatBufferCursor(this.buffer, this.index);

High

Child Process

Package source references child process execution.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg · L27324

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg

48331} L48332: if (!pluginMod) pluginMod = await import( L48333: /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg · L48331

bin/cli.jsView file

Lines 1619-1659javascript

1619 if (user) {

1620 const prof = fromParts({ name: user.name, email: user.email }, "cloud");

1621 if (prof) {

1622 writeLocalProfile(prof);

1623 return

app/main/index.cjsView file

Lines 1-22javascript

1"use strict";

2const electron = require("electron");

3const node_child_process = require("node:child_process");

4const node_crypto

Lines 2519-2559javascript

2519 if (process.platform === "darwin") return join10(homedir7(), "Library", "Caches", "electron");

2520 return join10(process.env.XDG_CACHE_HOME ?? join10(homedir7(), ".cache"), "electron");

2521}

2522function cachedElectronZip(version, platform, arch) {

2523 const root = electronCacheDir();

2524 const want = `electron-v${version}-${platform}-${arch}.zip`;

2525 try {

2526 let best = null;

2527 for (const sub of readdirSync2(root)) {

2528 const f = join10(root, sub, want);

2529 if (!existsSync11(f)) continue;

2530 const mtime = statSync5(f).mtimeMs;

2531 if (!best || mtime > best.mtime) best = { file: f, mtime };

2532 }

2533 return best?.file ?? null;

2534 } catch {

2535 return null;

2536 }

2537}

2538function expandArchiveWindows(zipPath, destDir) {

2539 const r = spawnSync(

2540 "powershell.exe",

2541 ["-NoProfile", "-NonInteractive", "-Command", "Expand-Archive -LiteralPath $env:INPLAN_ZIP_PATH -DestinationPath $env:INPLAN_DEST_DIR -Force"],

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L2539

2542 { stdio: "ignore", env: { ...process.env, INPLAN_ZIP_PATH: zipPath, INPLAN_DEST_DIR: destDir } }

2543 );

2544 return r.status === 0;

2545}

2546function autoInstallElectron(reqUrl) {

2547 if (process.env.INPLAN_NO_ELECTRON_DOWNLOAD === "1") return false;

2548 try {

2549 const pkgDir = dirname11(createRequire(reqUrl).resolve("electron/package.json"));

2550 const installJs = join10(pkgDir, "install.js");

2551 if (!existsSync11(installJs)) return false;

2552 process.stderr.write("[inplan] editor runtime missing \u2014 retrying the download \u2026\n");

2553 execFileSync2(process.execPath, [installJs], { cwd: pkgDir, stdio: "inherit", env: process.env });

2554 if (electronBinaryFromDisk(reqUrl) !== null) return true;

2555 if (process.platform === "win32") {

2556 const { version } = JSON.parse(readFileSync11(join10(pkgDir, "package.json"), "utf8"));

2557 const zip = cachedElectronZip(version, "win32", process.env.npm_config_arch || process.arch);

2558 if (zip && expandArchiveWindows(zip, join10(pkgDir, "dist"))) {

2559 writeFileSync10(join10(pkgDir, "path.txt"), "electron.exe");