registry / AI-agent control-surface risk / lm-assist

lm-assist

Full observability & control for the Claude product line — Claude Code (local/remote/cloud), claude.ai conversations, Cowork, agents, memory, connectors, usage — via web dashboard, REST API, and MCP tools

This report shows the evidence for lm-assist@0.2.4. 2 of 3 known versions are blocked or flagged. The newest version, 0.2.5, is flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic postinstall chain mutates Claude Code's control surface and installs an external plugin during npm installation. This is concrete unconsented install-hook abuse.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation runs the postinstall lifecycle hook.

Impact

It changes a broad AI-agent control surface and starts package services during installation.

Mechanism

Postinstall service startup and Claude Code plugin/configuration mutation.

Policy narrative

Installing the package globally triggers postinstall. The script starts lm-assist services, calls a local endpoint that writes a status-line command into Claude Code settings, and uses the Claude CLI to add a marketplace and install a plugin. These changes occur without an explicit lm-assist setup command.

AI rationale

The automatic postinstall chain mutates Claude Code's control surface and installs an external plugin during npm installation. This is concrete unconsented install-hook abuse.

Evidence

package.jsonbin/postinstall.jscore/dist/routes/core/claude-code.routes.js~/.claude/settings.json~/.claude/plugins/installed_plugins.json

Network endpoints1

127.0.0.1

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs a postinstall script automatically.
For global installs, postinstall starts the package services and requests statusline installation.
Postinstall automatically adds a Claude marketplace and installs a Claude plugin when the CLI is present.
The invoked statusline route writes a command into Claude Code settings.

Evidence against

The postinstall script exits for source installs.
No runtime dependency on lm-assist itself appears in the manifest.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

Manifest

CopyleftLicense

scanned 662 file(s), 8.49 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.langmart.ai, assist.langmart.ai, claude.ai, github.com, graph.facebook.com, local-tier.invalid, mail.google.com, nodejs.org, platform.claude.com, raw.githubusercontent.com, www.linkedin.com

Source & flagged code

34 flagged

package.jsonView file

Lines 74-104json

74 "pidtree": "^0.6.0",

75 "puppeteer-core": "24.43.1",

76 "selfsigned": "^2.4.1",

77 "tree-kill": "^1.2.2",

78 "uuid": "^9.0.0",

79 "ws": "^8.18.0"

80 },

81 "workspaces": [

82 "core",

83 "web"

84 ],

85 "scripts": {

86 "build:core": "cd core && npm run build",

87 "build:web": "cd web && npm run build",

88 "build": "npm run build:core && npm run build:web",

89 "start": "node bin/lm-assist.js start",

90 "stop": "node bin/lm-assist.js stop",

91 "restart": "node bin/lm-assist.js restart",

92 "prepublishOnly": "npm run build:core",

93 "prepare": "npm run build",

94 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L94

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L94

95 },

96 "overrides": {

97 "global-agent": "^4.1.2"

98 },

99 "publishConfig": {

100 "access": "public",

101 "registry": "https://registry.npmjs.org/"

102 }

103}

104

44Install-time code directly mutates a foreign AI-agent control surface: L44: "bin", L45: ".claude-plugin", L46: ".mcp.json", L47: "commands", Write operation from core/dist/utils/install-source.js: L65: const f = markerFile(); L66: fs.mkdirSync(path.dirname(f), { recursive: true }); L67: const tmp = f + '.tmp'; L68: fs.writeFileSync(tmp, JSON.stringify(rec, null, 2), { mode: 0o600 }); L69: fs.renameSync(tmp, f); Foreign user/project scope from core/dist/utils/path-utils.js: L303: * Get the Claude config directory L304: * Default: ~/.claude L305: * Can be overridden with CLAUDE_CONFIG_DIR env var ... L307: function getClaudeConfigDir() { L308: return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'); L309: } ... L311: * Get the projects directory L312: * Default: ~/.claude/

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

core/dist/service-manager.jsView file

Lines 38-78javascript

38 return result;

39 };

40})();

41Object.defineProperty(exports, "__esModule", { value: true });

42exports.startCore = startCore;

43exports.startWeb =

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

39}; L40: var __privateIn = (member, obj) => { L41: if (Object(obj) !== obj) ... L71: L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js L73: var require_symbols = __commonJS({ ... L98: kBodyUsed: Symbol("used"), L99: kBody: Symbol("abstracted request body"), L100: kRunning: Symbol("running"), ... L564: } L565: const code = this.code = key.charCodeAt(index); L566: if (code > 127) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

core/dist/routes/core/tmux.routes.jsView file

Lines 32-72javascript

32 var ar = [];

33 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

core/scripts/memory-reconcile.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * memory-reconcile.js -- Stream A reconciliation tier: dedup/merge + dependency

4 * mapping + outdated/superseded detection.

5 *

6 * PLAN-DEFAULT: writes a plan to ~/.lm-assist/memory-reconcile-plan.jsonl.

7 * NEVER auto-deletes, auto-merges, or auto-edits memory files.

8 * NEVER git-commits unless --apply AND MEMORY_RECONCILE_APPLY=on are BOTH set.

9 *

10 * Spec: docs/plans/2026-06-06-record-level-memory-map-and-sync.md sec 9, 12, 13.

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={462:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

bin/lm-assist.jsView file

25Cross-file remote execution chain: bin/lm-assist.js spawns core/dist/backup/config.js; helper contains network access plus dynamic code execution. L25: try { L26: const dir = process.env.LM_ASSIST_DATA_DIR || path.join(os.homedir(), '.lm-assist'); L27: const t = fs.readFileSync(path.join(dir, 'api-token'), 'utf8').trim(); ... L54: const cfgPath = path.join(os.homedir(), '.claude-code-config.json'); L55: const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')); L56: return { ... L169: L170: More info: https://github.com/langmartai/lm-assist L171: `); ... L192: fs.copyFileSync(upgradeScript, tmpScript); L193: const { execFileSync } = require('child_process'); L194: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 80

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = bin/lm-assist.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lm-assist.js

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

core/dist/ui-pages/manager.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/ui-pages/manager.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ui-pages/manager.jsView on unpkg

core/dist/cli-runner.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/cli-runner.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/cli-runner.jsView on unpkg

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = bin/postinstall.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

core/dist/mcp-server/plugins/client.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/mcp-server/plugins/client.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/mcp-server/plugins/client.jsView on unpkg

core/dist/memory/autosync.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/memory/autosync.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/autosync.jsView on unpkg

core/dist/memory/harvest-daemon.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/memory/harvest-daemon.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/harvest-daemon.jsView on unpkg

core/dist/rest-server.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/rest-server.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/rest-server.jsView on unpkg

core/dist/routes/core/dev-mode.routes.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/routes/core/dev-mode.routes.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/dev-mode.routes.jsView on unpkg

core/dist/routes/core/machine-access.routes.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/routes/core/machine-access.routes.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/machine-access.routes.jsView on unpkg

core/dist/ttyd-manager.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/ttyd-manager.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ttyd-manager.jsView on unpkg

core/dist/utils/claude-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/utils/claude-oauth.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/utils/claude-oauth.jsView on unpkg

Source & flagged code

34 flagged · loading source

package.jsonView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Findings

3 Critical24 High9 Medium8 Low

CriticalReverse Shellcore/dist/service-manager.js

CriticalAi Agent Control Hijackpackage.json

CriticalTrigger Reachable Dangerous Capabilitycore/dist/service-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcore/dist/service-manager.js

HighShell

HighSame File Env Network Executioncore/scripts/memory-reconcile.js

HighCommand Output Exfiltrationweb/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js

HighSandbox Evasion Gated Capabilitycore/dist/service-manager.js

HighCross File Remote Execution Contextbin/lm-assist.js

HighTrigger Reachable Persistencecore/dist/routes/core/tmux.routes.js

Affected versions and remediation

This report applies to lm-assist@0.2.4.

The versions list below shows the verdict for each recorded version.

Avoid installing lm-assist@0.2.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-13 11:55:48.694Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.2.5latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 23, 2026, 2:57 AM 0.2.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 5, 2026, 7:38 PM 0.2.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 1, 2026, 9:20 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code