Loading npm security reports…

izanagi-ai@3.9.0: AI-agent control-surface risk | LPM Firewall

registry / izanagi-ai / 3.9.0

izanagi-ai@3.9.0

Izanagi AI - Modular Skill-Oriented AI Prompt & Agent Framework for Autonomous Software Engineering

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consuming project’s AI-agent instruction surface without an explicit command. It installs all supported CLI adapters and framework files.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install of izanagi-ai as a dependency

Impact

Future AI CLI sessions may load package-provided instructions and agents.

Mechanism

unconsented postinstall project-wide AI-agent configuration injection

Policy narrative

Installing the package invokes a bootstrap that imports the lifecycle implementation. For dependency installs it uses npm’s INIT_CWD as the consumer project, then calls the installer with every pack and target CLI set to all. The installer copies framework content into .agents, writes root AGENTS.md/SYSTEM.md/RULES.md, creates opencode.json, and generates adapters for Claude, Cursor, Codex, Copilot, Kimi, and OpenCode. This is an unconsented install-time mutation of a broad foreign AI-agent control surface.

Rationale

Source confirms concrete npm postinstall mutation of the consuming project’s multi-vendor AI-agent configuration surface. This meets the blocking policy regardless of the absence of confirmed exfiltration.

Evidence

package.jsonbin/postinstall.jsdist/scripts/postinstall.jsdist/installer.jsdist/exporters.jsskills/ui-ux-pro-max/scripts/tests/test_core.py<consumer-project>/.agents<consumer-project>/AGENTS.md

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

35} else { L36: await import(target); L37: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall.jsView on unpkg · L35

dist/runtime/contracts/artifacts.jsView file

1/** L2: * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

dist/installer.jsView file

10Install-time code directly mutates a foreign AI-agent control surface: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'CHANGELOG.md', 'ROADMAP.md'], L13: default: true ... L93: if (stats.isDirectory()) { L94: fs.mkdirSync(dest, { recursive: true }); L95: fs.readdirSync(src).forEach((childItemName) => { ... L101: if (!fs.existsSync(parentDir)) { L102: fs.mkdirSync(parentDir, { recursive: true }); L103: } L104: fs.copyFileSync(src, dest); L105: } Write operation from dist/installer.js: L10: label: 'Core', L11: description: 'Engines (Decision, Context, Reflection...) + SYSTEM.md / RULES.md / AGENTS.md', L12: files: ['core', 'SYSTEM.md', 'RULES.md', 'AGENTS.md', 'C

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/installer.jsView on unpkg · L10

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function resolveframeworkroot(cwd) { const projectagents = path.join(cwd, '.agents'); if (fs.existssync(path.join(projectagents, 'core'))) { return projectagents; } return getpackagedir(); } export function installtoproject(targetdir, selectedpackids, clitarget) { const destinationroot = path.resolve(targetdir); const packagedir = getpackagedir(); const packids = array.from(new set([core_pack_id, ...selectedpackids])); const packs = packs.filter((p) => packids.includes(p.id)); if (!fs

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/runtime/tests/unicode-hygiene.test.jsView file

18contains invisible/control Unicode U+202E (right-to-left override) const dirty = `${'<U+FEFF>'}function f()${'<U+2060>'} { return${'<U+202E>'}1; }`;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/runtime/tests/unicode-hygiene.test.jsView on unpkg · L18

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 63694 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 5901 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 29-69json

29 "testing",

30 ".opencode",

31 ".claude",

32 ".codex",

33 ".cursor",

34 ".github",

35 ".kimi",

36 "references",

37 "benchmarks",

38 "SYSTEM.md",

39 "RULES.md",

40 "AGENTS.md",

41 "CLAUDE.md",

42 "kimi.md",

43 "CHANGELOG.md",

44 "ROADMAP.md",

45 ".manifest"

46 ],

47 "scripts": {

48 "build": "tsc && node dist/scripts/generate-manifest.js",

49 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "build:clean": "node dist/scripts/build-clean.js",

51 "verify": "node dist/scripts/verify-build.js && node --test \"dist/runtime/tests/*.test.js\"",

52 "test": "npm run build && node --test \"dist/runtime/tests/*.test.js\"",

53 "test:only": "node --test \"dist/runtime/tests/*.test.js\"",

54 "release": "node dist/scripts/release.js",

55 "release:patch": "node dist/scripts/release.js patch",

56 "release:minor": "node dist/scripts/release.js minor",

57 "release:major": "node dist/scripts/release.js major",

58 "bump": "node dist/scripts/bump.js",

59 "bump:patch": "node dist/scripts/bump.js patch",

60 "bump:minor": "node dist/scripts/bump.js minor",

61 "bump:major": "node dist/scripts/bump.js major",

62 "prepublishOnly": "npm run build",

63 "start": "node bin/izanagi.js",

64 "doctor": "node bin/izanagi.js doctor",

65 "list": "node bin/izanagi.js list"

66 },

67 "keywords": [

68 "izanagi",

69 "izanagi-ai",

bin/postinstall.jsView file

Lines 15-38javascript

15 * engole erros reais: falha de carga ou exit code não-zero do script delega

16 * se propaga (unhandled rejection / exitCode).

17 * - `dist/` AUSENTE (dev/

dist/runtime/contracts/artifacts.jsView file

Lines 1-21javascript

1/**

2 * Contracts & Artifacts — schemas de artefatos + validação programática.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/runtime/contracts/artifacts.jsView on unpkg · L1

3 *

4 * Artefato inválido → INVALID → REPAIR → RE-EVALUATE.

5 * O validators.ts aplica os schemas sobre artefatos (string | objeto) e

6 * devolve issues estruturadas.

7 */

8import crypto from

dist/installer.jsView file

Lines 1-30javascript

1import fs from 'fs';

2import path from 'path';

3import { fileURLToPath } from 'url';

4import { exportToClaude, exportToCodex, exportToCursor, exportToCopilot, exportToKimi, exportToOpencode } from './exporters.js';

dist/runtime/tests/unicode-hygiene.test.jsView file

Lines 1-38javascript

1import test from 'node:test';

2import assert from 'node:assert/strict';

3import { sanitizeText } from '../text/unicode-hygiene.js';

4test('unicode-hygiene: remove zero-width space no meio de um identificador', () =>

skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = skills/ui-ux-pro-max/scripts/design_system.py kind = build_helper sizeBytes = 63694 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

skills/ui-ux-pro-max/scripts/tests/test_core.pyView file

•path = skills/ui-ux-pro-max/scripts/tests/test_core.py kind = payload_in_excluded_dir sizeBytes = 5901 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/scripts/tests/test_core.pyView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = izanagi-ai@3.4.0 matchedIdentity = npm:aXphbmFnaS1haQ:3.4.0 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg