Loading npm security reports…

izanagi-ai@3.20.1: AI-agent control-surface risk | LPM Firewall

registry / izanagi-ai / 3.20.1

izanagi-ai@3.20.1

Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically mutates the consumer project into an AI-agent framework installation. It installs all adapters and creates agent-control instruction files without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall when izanagi-ai is installed as a dependency

Impact

The consumer project's AI tooling can load package-authored instructions and agents by default.

Mechanism

Automatic broad AI-agent configuration and instruction injection into INIT_CWD

Policy narrative

The package registers a postinstall hook. When installed under node_modules, it uses npm's INIT_CWD as the consumer project and automatically installs every framework pack and all AI CLI adapters. The installer copies package-controlled content into .agents and writes root AGENTS.md, SYSTEM.md, RULES.md, and an opencode.json that auto-loads the injected instructions. This is unconsented install-time mutation of a broad AI-agent control surface.

AI rationale

This is a concrete automatic lifecycle attack path, not an explicit CLI setup action. Although no exfiltration was found in the inspected install path, the broad cross-platform agent-control mutation meets the publish-block policy.

Evidence

package.jsondist/scripts/postinstall.jsdist/installer.js.agents/AGENTS.mdSYSTEM.mdRULES.md.izanagi/izanagi.config.jsonopencode.json

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

35} else { L36: await import(target); L37: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L35

dist/runtime/contracts/artifacts.jsView file

152* comando não chegou a rodar, e exigi-lo forçaria o "não medi" a virar L153: * `false`, que se lê como "os testes falharam". `exitCode` e `command` são L154: * obrigatórios porque sem eles o artefato não diz o que foi executado nem

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L152

dist/installer.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'CHANGELOG.md', 'ROADMAP.md'], L13: default: true ... L93: if (stats.isDirectory()) { L94: fs.mkdirSync(dest, { recursive: true }); L95: fs.readdirSync(src).forEach((childItemName) => { ... L101: if (!fs.existsSync(parentDir)) { L102: fs.mkdirSync(parentDir, { recursive: true }); L103: } L104: fs.copyFileSync(src, dest); L105: } Write operation from dist/installer.js: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'C

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function resolvestateroot(cwd) { const projectagents = path.join(cwd, '.agents'); if (fs.existssync(path.join(projectagents, 'core'))) { return projectagents; } return path.resolve(cwd); } export function installtoproject(targetdir, selectedpackids, clitarget) { const destinationroot = path.resolve(targetdir); const packagedir = getpackagedir(); const packids = array.from(new set([core_pack_id, ...selectedpackids])); const packs = packs.filter((p) => packids.includes(p.id)); if (!fs.e

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/runtime/tests/unicode-hygiene.test.jsView file

18contains invisible/control Unicode U+202E (right-to-left override) const dirty = `${'<U+FEFF>'}function f()${'<U+2060>'} { return${'<U+202E>'}1; }`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/runtime/tests/unicode-hygiene.test.jsView on unpkg · L18

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 65173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 6035 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/runtime/tools/code-sandbox.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.19.0 matchedPath = dist/runtime/tools/code-sandbox.js matchedIdentity = npm:aXphbmFnaS1haQ:3.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.375 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

dist/runtime/tests/code-sandbox.test.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.19.0 matchedPath = dist/runtime/tests/code-sandbox.test.js matchedIdentity = npm:aXphbmFnaS1haQ:3.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tests/code-sandbox.test.jsView on unpkg

dist/cli/index.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.19.0 matchedPath = dist/cli/index.js matchedIdentity = npm:aXphbmFnaS1haQ:3.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/scripts/release.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.19.0 matchedPath = dist/scripts/release.js matchedIdentity = npm:aXphbmFnaS1haQ:3.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/release.jsView on unpkg