Loading npm security reports…

izanagi-ai@3.19.0: AI-agent control-surface risk | LPM Firewall

registry / izanagi-ai / 3.19.0

izanagi-ai@3.19.0

Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically writes its framework and behavior-bearing AI-agent instructions into the consumer project. It activates all supported AI CLI integrations without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation as a dependency

Impact

A dependency installation alters broad project and AI-agent control surfaces, causing later AI tools to load package-authored instructions.

Mechanism

postinstall copies packs and generates all AI CLI adapters in INIT_CWD

Policy narrative

During npm postinstall, the bootstrap dynamically loads the installer. When installed under node_modules, it uses INIT_CWD as the consumer project, copies framework packs and root instruction files, writes configuration, and requests generation of adapters for Claude, Codex, Cursor, Copilot, Kimi, and OpenCode. This is an unconsented, broad AI-agent control-surface mutation triggered solely by dependency installation.

Rationale

The automatic postinstall chain deliberately modifies the consumer project's AI-agent instruction and adapter surfaces across multiple vendors. This satisfies the policy for malicious install-hook abuse even though no network exfiltration was found.

Evidence

package.jsonbin/postinstall.jsdist/scripts/postinstall.jsdist/installer.jsdist/exporters.js.agents/.izanagi/izanagi.config.jsonAGENTS.mdSYSTEM.md

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

35} else { L36: await import(target); L37: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L35

dist/runtime/contracts/artifacts.jsView file

1/** L2: * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

dist/installer.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'CHANGELOG.md', 'ROADMAP.md'], L13: default: true ... L93: if (stats.isDirectory()) { L94: fs.mkdirSync(dest, { recursive: true }); L95: fs.readdirSync(src).forEach((childItemName) => { ... L101: if (!fs.existsSync(parentDir)) { L102: fs.mkdirSync(parentDir, { recursive: true }); L103: } L104: fs.copyFileSync(src, dest); L105: } Write operation from dist/installer.js: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'C

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function resolvestateroot(cwd) { const projectagents = path.join(cwd, '.agents'); if (fs.existssync(path.join(projectagents, 'core'))) { return projectagents; } return path.resolve(cwd); } export function installtoproject(targetdir, selectedpackids, clitarget) { const destinationroot = path.resolve(targetdir); const packagedir = getpackagedir(); const packids = array.from(new set([core_pack_id, ...selectedpackids])); const packs = packs.filter((p) => packids.includes(p.id)); if (!fs.e

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/runtime/tests/unicode-hygiene.test.jsView file

18contains invisible/control Unicode U+202E (right-to-left override) const dirty = `${'<U+FEFF>'}function f()${'<U+2060>'} { return${'<U+202E>'}1; }`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/runtime/tests/unicode-hygiene.test.jsView on unpkg · L18

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 65173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 6035 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/runtime/tools/code-sandbox.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 30-70json

30 ".opencode",

31 ".claude",

32 ".codex",

33 ".cursor",

34 ".github",

35 ".kimi",

36 "references",

37 "benchmarks",

38 "SYSTEM.md",

39 "RULES.md",

40 "AGENTS.md",

41 "CLAUDE.md",

42 "kimi.md",

43 "CHANGELOG.md",

44 "ROADMAP.md",

45 "docs",

46 ".manifest"

47 ],

48 "scripts": {

49 "build": "tsc && node dist/scripts/generate-manifest.js",

50 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "build:clean": "node dist/scripts/build-clean.js",

52 "verify": "node dist/scripts/verify-build.js && node --test \"dist/runtime/tests/*.test.js\"",

53 "test": "npm run build && node --test \"dist/runtime/tests/*.test.js\"",

54 "test:only": "node --test \"dist/runtime/tests/*.test.js\"",

55 "release": "node dist/scripts/release.js",

56 "release:patch": "node dist/scripts/release.js patch",

57 "release:minor": "node dist/scripts/release.js minor",

58 "release:major": "node dist/scripts/release.js major",

59 "bump": "node dist/scripts/bump.js",

60 "bump:patch": "node dist/scripts/bump.js patch",

61 "bump:minor": "node dist/scripts/bump.js minor",

62 "bump:major": "node dist/scripts/bump.js major",

63 "prepublishOnly": "npm run build",

64 "start": "node bin/izanagi.js",

65 "doctor": "node bin/izanagi.js doctor",

66 "list": "node bin/izanagi.js list"

67 },

68 "keywords": [

69 "izanagi",

70 "izanagi-ai",

bin/postinstall.jsView file

Lines 15-38javascript

15 * engole erros reais: falha de carga ou exit code não-zero do script delega

16 * se propaga (unhandled rejection / exitCode).

17 * - `dist/` AUSENTE (dev/

dist/runtime/contracts/artifacts.jsView file

Lines 1-21javascript

1/**

2 * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

3 *

4 * Artefato inválido → INVALID → REPAIR → RE-EVALUATE.

5 * O validators.ts aplica os schemas sobre artefatos (string | objeto) e

6 * devolve issues estruturadas.

7 */

8import crypto from

dist/installer.jsView file

Lines 1-30javascript

1import fs from 'fs';

2import path from 'path';

3import { fileURLToPath } from 'url';

4import { exportToClaude, exportToCodex, exportToCursor, exportToCopilot, exportToKimi, exportToOpencode } from './exporters.js';

dist/runtime/tests/unicode-hygiene.test.jsView file

Lines 1-38javascript

1import test from 'node:test';

2import assert from 'node:assert/strict';

3import { sanitizeText } from '../text/unicode-hygiene.js';

4test('unicode-hygiene: remove zero-width space no meio de um identificador', () =>

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 65173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 6035 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/runtime/tools/code-sandbox.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg