Loading npm security reports…

izanagi-ai@3.17.1: AI-agent control-surface risk | LPM Firewall

registry / izanagi-ai / 3.17.1

izanagi-ai@3.17.1

Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation as a dependency, the package automatically initializes the consumer project. It copies framework material and generates instruction and agent files for all supported AI CLIs without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during dependency installation

Impact

It changes behavior-bearing AI-agent control surfaces across multiple platforms and writes project-root instruction files.

Mechanism

Automatic broad AI-agent configuration injection into the consumer project

Policy narrative

Installing the dependency invokes the bootstrap, which loads the published postinstall script. That script identifies a consumer dependency installation and initializes the consumer project using all packs and all AI CLI adapters. The installer recursively copies framework content, writes project-root instruction files and configuration, and generates platform-specific agent files. This is an unconsented postinstall mutation of broad AI-agent control surfaces.

AI rationale

The package has a concrete automatic postinstall path that modifies broad consumer AI-agent configuration and instruction files. This meets the install-hook abuse blocking policy even without evidence of network exfiltration.

Evidence

package.jsonbin/postinstall.jsdist/scripts/postinstall.jsdist/installer.jsdist/exporters.js.agents/AGENTS.mdSYSTEM.md

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

35} else { L36: await import(target); L37: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L35

dist/runtime/contracts/artifacts.jsView file

1/** L2: * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

dist/installer.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'CHANGELOG.md', 'ROADMAP.md'], L13: default: true ... L93: if (stats.isDirectory()) { L94: fs.mkdirSync(dest, { recursive: true }); L95: fs.readdirSync(src).forEach((childItemName) => { ... L101: if (!fs.existsSync(parentDir)) { L102: fs.mkdirSync(parentDir, { recursive: true }); L103: } L104: fs.copyFileSync(src, dest); L105: } Write operation from dist/installer.js: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'C

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function resolveframeworkroot(cwd) { const projectagents = path.join(cwd, '.agents'); if (fs.existssync(path.join(projectagents, 'core'))) { return projectagents; } return getpackagedir(); } export function installtoproject(targetdir, selectedpackids, clitarget) { const destinationroot = path.resolve(targetdir); const packagedir = getpackagedir(); const packids = array.from(new set([core_pack_id, ...selectedpackids])); const packs = packs.filter((p) => packids.includes(p.id)); if (!fs

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/runtime/tests/unicode-hygiene.test.jsView file

18contains invisible/control Unicode U+202E (right-to-left override) const dirty = `${'<U+FEFF>'}function f()${'<U+2060>'} { return${'<U+202E>'}1; }`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/runtime/tests/unicode-hygiene.test.jsView on unpkg · L18

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 65173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 6035 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/runtime/tools/code-sandbox.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/runtime/tools/code-sandbox.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.594 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

dist/runtime/tests/code-sandbox.test.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/runtime/tests/code-sandbox.test.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tests/code-sandbox.test.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 30-70json

30 ".opencode",

31 ".claude",

32 ".codex",

33 ".cursor",

34 ".github",

35 ".kimi",

36 "references",

37 "benchmarks",

38 "SYSTEM.md",

39 "RULES.md",

40 "AGENTS.md",

41 "CLAUDE.md",

42 "kimi.md",

43 "CHANGELOG.md",

44 "ROADMAP.md",

45 "docs",

46 ".manifest"

47 ],

48 "scripts": {

49 "build": "tsc && node dist/scripts/generate-manifest.js",

50 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "build:clean": "node dist/scripts/build-clean.js",

52 "verify": "node dist/scripts/verify-build.js && node --test \"dist/runtime/tests/*.test.js\"",

53 "test": "npm run build && node --test \"dist/runtime/tests/*.test.js\"",

54 "test:only": "node --test \"dist/runtime/tests/*.test.js\"",

55 "release": "node dist/scripts/release.js",

56 "release:patch": "node dist/scripts/release.js patch",

57 "release:minor": "node dist/scripts/release.js minor",

58 "release:major": "node dist/scripts/release.js major",

59 "bump": "node dist/scripts/bump.js",

60 "bump:patch": "node dist/scripts/bump.js patch",

61 "bump:minor": "node dist/scripts/bump.js minor",

62 "bump:major": "node dist/scripts/bump.js major",

63 "prepublishOnly": "npm run build",

64 "start": "node bin/izanagi.js",

65 "doctor": "node bin/izanagi.js doctor",

66 "list": "node bin/izanagi.js list"

67 },

68 "keywords": [

69 "izanagi",

70 "izanagi-ai",

bin/postinstall.jsView file

Lines 15-38javascript

15 * engole erros reais: falha de carga ou exit code não-zero do script delega

16 * se propaga (unhandled rejection / exitCode).

17 * - `dist/` AUSENTE (dev/

dist/runtime/contracts/artifacts.jsView file

Lines 1-21javascript

1/**

2 * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

3 *

4 * Artefato inválido → INVALID → REPAIR → RE-EVALUATE.

5 * O validators.ts aplica os schemas sobre artefatos (string | objeto) e

6 * devolve issues estruturadas.

7 */

8import crypto from

dist/installer.jsView file

Lines 1-30javascript

1import fs from 'fs';

2import path from 'path';

3import { fileURLToPath } from 'url';

4import { exportToClaude, exportToCodex, exportToCursor, exportToCopilot, exportToKimi, exportToOpencode } from './exporters.js';

dist/runtime/tests/unicode-hygiene.test.jsView file

Lines 1-38javascript

1import test from 'node:test';

2import assert from 'node:assert/strict';

3import { sanitizeText } from '../text/unicode-hygiene.js';

4test('unicode-hygiene: remove zero-width space no meio de um identificador', () =>

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 65173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 6035 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/runtime/tools/code-sandbox.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/runtime/tools/code-sandbox.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.594 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

dist/runtime/tests/code-sandbox.test.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/runtime/tests/code-sandbox.test.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tests/code-sandbox.test.jsView on unpkg