Loading npm security reports…

lean-ctx-bin@3.9.19: AI-agent control-surface risk | LPM Firewall

registry / lean-ctx-bin / 3.9.19

lean-ctx-bin@3.9.19

LeanCTX — the Context OS for AI coding agents. One local binary that compresses, remembers, routes, and verifies every token between your code and the model. No Rust required.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the package downloads a release binary and executes its onboarding mode without an affirmative setup command. That mode is explicitly described as connecting AI tools, leaving the actual configuration behavior opaque in the remote native payload.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install (postinstall) outside CI unless LEAN_CTX_NO_ONBOARD=1

Impact

Potential unconsented mutation of AI-agent/editor control surfaces by an opaque native binary.

Mechanism

remote binary download followed by automatic AI-tool onboarding execution

Policy narrative

Installing the package triggers postinstall, which discovers and downloads a platform binary from GitHub, places it in bin/, and immediately invokes its onboard command. The JavaScript explicitly describes this as connecting AI tools. The package source does not expose the native binary's configuration operations, while its README indicates comparable setup should be a user-run command; installation therefore performs unconsented AI-tool onboarding.

Rationale

The package executes an opaque downloaded native payload during postinstall and automatically requests AI-tool onboarding. This is a concrete unconsented install-time AI-agent control-surface risk, despite no observed credential exfiltration in the reviewed JavaScript. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonpostinstall.jsREADME.mdbin/lean-ctx.jsbin/lean-ctxbin/lean-ctx.exe

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L31: L32: function getTarget() { L33: const platform = process.platform; ... L42: const archMap = { x64: "x86_64", arm64: "aarch64" }; L43: const rustArch = archMap[arch]; L44: if (!rustArch) { L45: console.error(`Unsupported architecture: ${arch}`); ... L47: }

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L6

•scripts.preinstall = node preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

3L4: const { execSync } = require("child_process"); L5: const fs = require("fs"); L6: const path = require("path"); L7: const https = require("https"); L8: const { createGunzip } = require("zlib"); L9: const crypto = require("crypto"); ... L11: const REPO = "yvgude/lean-ctx"; L12: const BIN_DIR = path.join(__dirname, "bin"); L13: const IS_WIN = process.platform === "win32"; L14: const BINARY_NAME = IS_WIN ? "lean-ctx.exe" : "lean-ctx"; ... L128: lastPct = pct;

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

postinstall.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = lean-ctx-bin@3.9.17 matchedIdentity = npm:bGVhbi1jdHgtYmlu:3.9.17 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

postinstall.jsView on unpkg