Loading npm security reports…

lean-ctx-bin@3.10.1: AI-agent control-surface risk | LPM Firewall

registry / lean-ctx-bin / 3.10.1

lean-ctx-bin@3.10.1

LeanCTX — a local Context SDK for AI agents. Select, shape, reuse, recover, and measure context before inference. No Rust required.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation downloads a remote native executable and runs its AI-tool onboarding action. The executable is not bundled for inspection and can change through the latest-release lookup.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install or any lifecycle-enabled dependency installation

Impact

An unreviewable remote executable can modify AI-agent tooling during installation without an explicit setup command.

Mechanism

remote binary download followed by automatic AI-tool onboarding

Policy narrative

Installing the package invokes postinstall. It fetches release metadata, downloads a platform binary selected from the latest release, writes it to bin/lean-ctx, and immediately executes its onboard command. The source says that command connects AI tools, while the README frames setup as a separate user command that creates MCP and shell configuration. This bypasses that explicit action and delegates the sensitive configuration change to an opaque remote executable; checksum verification can be skipped when retrieval fails.

AI rationale

This is an unconsented install-time AI-agent control-surface action implemented through an opaque remotely fetched executable. Its automatic execution and fail-open verification create a concrete malicious lifecycle chain.

Evidence

package.jsonpostinstall.jsREADME.mdbin/lean-ctx/tmp/lean-ctx-*

Network endpoints2

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L31: L32: function getTarget() { L33: const platform = process.platform; ... L42: const archMap = { x64: "x86_64", arm64: "aarch64" }; L43: const rustArch = archMap[arch]; L44: if (!rustArch) { L45: console.error(`Unsupported architecture: ${arch}`); ... L47: }

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

3L4: const { execSync } = require("child_process"); L5: const fs = require("fs"); L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L11: const REPO = "yvgude/lean-ctx"; L12: const BIN_DIR = path.join(__dirname, "bin"); L13: const IS_WIN = process.platform === "win32"; L14: const BINARY_NAME = IS_WIN ? "lean-ctx.exe" : "lean-ctx"; ... L128: lastPct = pct;

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

postinstall.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.9.19 matchedPath = postinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7bde6fee4686d696 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = lean-ctx-bin@3.9.19 matchedPath = postinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.9.19 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

postinstall.js#virtual:normalized:round1View on unpkg

preinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.9.19 matchedPath = preinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-43json

1{

2 "name": "lean-ctx-bin",

3 "version": "3.10.1",

4 "description": "LeanCTX \u2014 a local Context SDK for AI agents. Select, shape, reuse, recover, and measure context before inference. No Rust required.",

5 "keywords": [

6 "lean-ctx",

7 "context-sdk",

8 "context-engineering",

9 "mcp",

10 "llm",

11 "context",

12 "claude",

13 "cursor",

14 "ai",

15 "ai-agents",

16 "code-graph",

17 "token-optimization"

18 ],

19 "homepage": "https://leanctx.com",

20 "repository": {

21 "type": "git",

22 "url": "https://github.com/yvgude/lean-ctx.git",

23 "directory": "packages/lean-ctx-bin"

24 },

25 "license": "Apache-2.0",

26 "bin": {

27 "lean-ctx": "./bin/lean-ctx.js"

28 },

29 "scripts": {

30 "preinstall": "node preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 },

33 "files": [

34 "bin/",

35 "preinstall.js",

36 "postinstall.js",

37 "README.md"

38 ],

39 "engines": {

40 "node": ">=16"

41 }

42}

43

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L6

postinstall.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3

4const { execSync } = require("child_process");

5const fs = require("fs");

postinstall.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

postinstall.js#virtual:normalized:round1View on unpkg

preinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lean-ctx-bin@3.9.19 matchedPath = preinstall.js matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

preinstall.jsView on unpkg