Loading npm security reports…

izanagi-ai@3.24.7: AI-agent control-surface risk | LPM Firewall

registry / izanagi-ai / 3.24.7

izanagi-ai@3.24.7

Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall hook automatically modifies the consuming project’s AI-agent control surface. It installs framework assets and generates adapters for all supported AI CLIs.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing izanagi-ai as a dependency runs postinstall.

Impact

A dependency installation can add agent instructions, framework configuration, and AI CLI integration files to a consumer project without an explicit setup command.

Mechanism

The bootstrap imports the lifecycle implementation, which uses INIT_CWD as the consumer project and calls the installer with every pack and the all-adapters target.

Policy narrative

The package lifecycle runs during dependency installation, identifies the consumer project through INIT_CWD, and automatically initializes its framework there. The initializer copies agent assets, writes project configuration, enables OpenCode to load package-authored instructions, and generates adapters for all supported AI CLI environments. This is an unconsented broad mutation of a foreign AI-agent control surface.

AI rationale

The active postinstall lifecycle performs broad AI-agent configuration changes in the consumer project without an explicit user command. This meets the install-hook control-surface blocking policy.

Evidence

package.jsonbin/postinstall.jsdist/scripts/postinstall.jsdist/installer.js.agentsAGENTS.mdSYSTEM.md.izanagi/izanagi.config.json

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

35} else { L36: await import(target); L37: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L35

dist/runtime/contracts/artifacts.jsView file

177* comando não chegou a rodar, e exigi-lo forçaria o "não medi" a virar L178: * `false`, que se lê como "os testes falharam". `exitCode` e `command` são L179: * obrigatórios porque sem eles o artefato não diz o que foi executado nem

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L177

dist/installer.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: // `references` entra aqui porque o runtime as LÊ de `<baseDir>/references/` L13: // (`cli/commands/run.ts` injeta as curadas no prompt, `cli/blueprint.ts` L14: // também). Sem elas no pack, `baseDir` de projeto inicializado é `.agents/` L15: // e a injeção nunca encontrava arquivo nenhum: o diretório viajava no L16: // tarball e não era instalado em lugar nenhum. L17: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'CHANGELOG.md', 'ROADMAP.md', 'references'], L18: default: true ... L98: if (stats.isDirectory()) { L99: fs.mkdirSync(dest, { recursive: true }); L100: fs.readdirSync(src).forEach

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. if (isframeworkrepo(destinationroot)) { console.log(`${escape_cyan}[izanagi ai]${escape_reset} repositório-fonte detectado em ${destinationroot}: o espelho de assets em .agents/ não é criado (o framework já é esses arquivos). `); return; } const targetagentsfolder = path.join(destinationroot, '.agents'); fs.mkdirsync(targetagentsfolder, { recursive: true }); console.log(`\n\x1b[36m[izanagi ai]\x1b[0m initializing framework in: \x1b[1m${destinationroot}\x1b[0m\n`); let copieditems = 0; for (const pack of packs) { const copied = pack.files.filter((item) => fs.existssync(path.join(packagedir, item))).length; if (copied === 0)

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/runtime/tests/unicode-hygiene.test.jsView file

18contains invisible/control Unicode U+202E (right-to-left override) const dirty = `${'<U+FEFF>'}function f()${'<U+2060>'} { return${'<U+202E>'}1; }`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/runtime/tests/unicode-hygiene.test.jsView on unpkg · L18

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 65173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 6035 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/runtime/llm/agent-cli.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/runtime/llm/agent-cli.js#virtual:normalized:round1View on unpkg

dist/runtime/llm/agent-cli.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/runtime/llm/agent-cli.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/llm/agent-cli.jsView on unpkg

dist/runtime/tools/code-sandbox.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.17.1 matchedPath = dist/runtime/tools/code-sandbox.js matchedIdentity = npm:aXphbmFnaS1haQ:3.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tools/code-sandbox.jsView on unpkg

dist/runtime/tools/project-test.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/runtime/tools/project-test.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tools/project-test.jsView on unpkg

dist/runtime/tests/code-sandbox.test.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.17.1 matchedPath = dist/runtime/tests/code-sandbox.test.js matchedIdentity = npm:aXphbmFnaS1haQ:3.17.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/tests/code-sandbox.test.jsView on unpkg

dist/cli/index.jsView file

•matchType = token_shingles matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/cli/index.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/scripts/release.jsView file

•matchType = normalized_sha256 matchedPackage = izanagi-ai@3.23.0 matchedPath = dist/scripts/release.js matchedIdentity = npm:aXphbmFnaS1haQ:3.23.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scripts/release.jsView on unpkg