Loading npm security reports…

lean-ctx-bin@3.10.0: Malicious npm security report (Block) | LPM Firewall

registry / lean-ctx-bin / 3.10.0

lean-ctx-bin@3.10.0

LeanCTX — a local Context SDK for AI agents. Select, shape, reuse, recover, and measure context before inference. No Rust required.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

Package installation fetches and installs a release-selected native executable, then automatically runs its AI-tool onboarding command. The executable is not present for source inspection and can mutate AI-tool configuration outside the package.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation or rebuild

Impact

An unreviewed remote native payload runs during installation and may alter AI-agent control surfaces.

Mechanism

Lifecycle download, executable drop, and automatic onboarding

Attack narrative

On installation, lifecycle hooks run without an explicit user command. The postinstall script discovers the latest GitHub release, downloads a native archive, installs an executable under bin, and invokes its onboard command to connect AI tools. The package source cannot establish what that downloaded binary changes, and its checksum check can be skipped. The preinstall hook also kills matching processes.

AI rationale

This is an unconsented install-time remote-payload chain that automatically invokes opaque AI-tool onboarding. The optional integrity check and process termination increase the risk.

Evidence

package.jsonpostinstall.jspreinstall.jsbin/lean-ctxbin/lean-ctx.exe

Network endpoints2

api.github.com

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L31: L32: function getTarget() { L33: const platform = process.platform; ... L42: const archMap = { x64: "x86_64", arm64: "aarch64" }; L43: const rustArch = archMap[arch]; L44: if (!rustArch) { L45: console.error(`Unsupported architecture: ${arch}`); ... L47: }

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

3L4: const { execSync } = require("child_process"); L5: const fs = require("fs"); L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L11: const REPO = "yvgude/lean-ctx"; L12: const BIN_DIR = path.join(__dirname, "bin"); L13: const IS_WIN = process.platform === "win32"; L14: const BINARY_NAME = IS_WIN ? "lean-ctx.exe" : "lean-ctx"; ... L128: lastPct = pct;

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

postinstall.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.10.1 matchedPath = postinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7bde6fee4686d696 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = lean-ctx-bin@3.10.1 matchedPath = postinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

postinstall.js#virtual:normalized:round1View on unpkg

preinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.10.1 matchedPath = preinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-43json

1{

2 "name": "lean-ctx-bin",

3 "version": "3.10.0",

4 "description": "LeanCTX \u2014 a local Context SDK for AI agents. Select, shape, reuse, recover, and measure context before inference. No Rust required.",

5 "keywords": [

6 "lean-ctx",

7 "context-sdk",

8 "context-engineering",

9 "mcp",

10 "llm",

11 "context",

12 "claude",

13 "cursor",

14 "ai",

15 "ai-agents",

16 "code-graph",

17 "token-optimization"

18 ],

19 "homepage": "https://leanctx.com",

20 "repository": {

21 "type": "git",

22 "url": "https://github.com/yvgude/lean-ctx.git",

23 "directory": "packages/lean-ctx-bin"

24 },

25 "license": "Apache-2.0",

26 "bin": {

27 "lean-ctx": "./bin/lean-ctx.js"

28 },

29 "scripts": {

30 "preinstall": "node preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "files": [

34 "bin/",

35 "preinstall.js",

36 "postinstall.js",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=16"

41 }

42}

43

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L6

postinstall.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3

4const { execSync } = require("child_process");

5const fs = require("fs");

postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

postinstall.js#virtual:normalized:round1View on unpkg

preinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.10.1 matchedPath = preinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg