lm-assist@0.2.0: AI-agent control-surface risk

Loading npm security reports…

lm-assist@0.2.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

21 flagged

package.jsonView file

Lines 74-104json

74 "pidtree": "^0.6.0",

75 "puppeteer-core": "24.43.1",

76 "selfsigned": "^2.4.1",

77 "tree-kill": "^1.2.2",

78 "uuid": "^9.0.0",

79 "ws": "^8.18.0"

80 },

81 "workspaces": [

82 "core",

83 "web"

84 ],

85 "scripts": {

86 "build:core": "cd core && npm run build",

87 "build:web": "cd web && npm run build",

88 "build": "npm run build:core && npm run build:web",

89 "start": "node bin/lm-assist.js start",

90 "stop": "node bin/lm-assist.js stop",

91 "restart": "node bin/lm-assist.js restart",

92 "prepublishOnly": "npm run build:core",

93 "prepare": "npm run build",

94 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L94

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L94

95 },

96 "overrides": {

97 "global-agent": "^4.1.2"

98 },

99 "publishConfig": {

100 "access": "public",

101 "registry": "https://registry.npmjs.org/"

102 }

103}

104

44Install-time code directly mutates a foreign AI-agent control surface: L44: "bin", L45: ".claude-plugin", L46: ".mcp.json", L47: "commands", Write operation from core/dist/utils/install-source.js: L65: const f = markerFile(); L66: fs.mkdirSync(path.dirname(f), { recursive: true }); L67: const tmp = f + '.tmp'; L68: fs.writeFileSync(tmp, JSON.stringify(rec, null, 2), { mode: 0o600 }); L69: fs.renameSync(tmp, f); Foreign user/project scope from core/dist/utils/path-utils.js: L303: * Get the Claude config directory L304: * Default: ~/.claude L305: * Can be overridden with CLAUDE_CONFIG_DIR env var ... L307: function getClaudeConfigDir() { L308: return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'); L309: } ... L311: * Get the projects directory L312: * Default: ~/.claude/

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

core/dist/service-manager.jsView file

Lines 38-78javascript

38 return result;

39 };

40})();

41Object.defineProperty(exports, "__esModule", { value: true });

42exports.startCore = startCore;

43exports.startWeb =

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

39}; L40: var __privateIn = (member, obj) => { L41: if (Object(obj) !== obj) ... L71: L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js L73: var require_symbols = __commonJS({ ... L98: kBodyUsed: Symbol("used"), L99: kBody: Symbol("abstracted request body"), L100: kRunning: Symbol("running"), ... L564: } L565: const code = this.code = key.charCodeAt(index); L566: if (code > 127) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

core/dist/routes/core/tmux.routes.jsView file

Lines 32-72javascript

32 var ar = [];

33 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

core/scripts/memory-reconcile.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * memory-reconcile.js -- Stream A reconciliation tier: dedup/merge + dependency

4 * mapping + outdated/superseded detection.

5 *

6 * PLAN-DEFAULT: writes a plan to ~/.lm-assist/memory-reconcile-plan.jsonl.

7 * NEVER auto-deletes, auto-merges, or auto-edits memory files.

8 * NEVER git-commits unless --apply AND MEMORY_RECONCILE_APPLY=on are BOTH set.

9 *

10 * Spec: docs/plans/2026-06-06-record-level-memory-map-and-sync.md sec 9, 12, 13.

bin/lm-assist.jsView file

25Cross-file remote execution chain: bin/lm-assist.js spawns core/dist/backup/config.js; helper contains network access plus dynamic code execution. L25: try { L26: const dir = process.env.LM_ASSIST_DATA_DIR || path.join(os.homedir(), '.lm-assist'); L27: const t = fs.readFileSync(path.join(dir, 'api-token'), 'utf8').trim(); ... L54: const cfgPath = path.join(os.homedir(), '.claude-code-config.json'); L55: const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')); L56: return { ... L169: L170: More info: https://github.com/langmartai/lm-assist L171: `); ... L192: fs.copyFileSync(upgradeScript, tmpScript); L193: const { execFileSync } = require('child_process'); L194: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 79

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

core/dist/service-manager.jsView file

58exports.readDevLog = readDevLog; L59: const child_process_1 = require("child_process"); L60: const fs = __importStar(require("fs")); L61: const path = __importStar(require("path")); L62: const net = __importStar(require("net")); L63: const os = __importStar(require("os")); ... L67: // ─── Paths ────────────────────────────────────────────────── L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..'); L69: function findNpmPackage() { ... L169: return { L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10), L171: webPort: cfg?.webPort || parseInt(process.env.WEB_PORT || env.WEB_PORT || defaults.web, 10),

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

core/dist/service-manager.jsView on unpkg · L58

58Trigger-reachable chain: manifest.main -> core/dist/index.js -> core/dist/rest-server.js -> core/dist/routes/index.js -> core/dist/routes/core/index.js -> core/dist/routes/core/claude-code.routes.js -> core/dist/service-manager.js L58: exports.readDevLog = readDevLog; L59: const child_process_1 = require("child_process"); L60: const fs = __importStar(require("fs")); L61: const path = __importStar(require("path")); L62: const net = __importStar(require("net")); L63: const os = __importStar(require("os")); ... L67: // ─── Paths ────────────────────────────────────────────────── L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..'); L69: function findNpmPackage() { ... L169: return { L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10)

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

core/dist/service-manager.jsView on unpkg · L58

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

47exports.deleteProjectSummary = deleteProjectSummary; L48: const fs = __importStar(require("fs")); L49: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/dist/project-summary-store.jsView on unpkg · L47

core/dist/routes/core/tmux.routes.jsView file

52Trigger-reachable persistence chain: manifest.main -> core/dist/index.js -> core/dist/rest-server.js -> core/dist/routes/index.js -> core/dist/routes/core/index.js -> core/dist/routes/core/tmux.routes.js L52: const process_utils_1 = require("../../utils/process-utils"); L53: const BASHRC = path.join(os.homedir(), '.bashrc'); L54: const TMUX_CONF = path.join(os.homedir(), '.tmux.conf'); ... L63: const raw = fs.readFileSync(TMUX_CONFIG_FILE, 'utf-8'); L64: const parsed = JSON.parse(raw); L65: return { ... L81: try { L82: const out = (0, exec_1.execFileSync)('tmux', ['-V'], { encoding: 'utf-8', timeout: 5000 }).trim(); L83: installed = true; ... L139: } L140: const inTmuxSession = !!process.env.TMUX; L141: return {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

52const process_utils_1 = require("../../utils/process-utils"); L53: const BASHRC = path.join(os.homedir(), '.bashrc'); L54: const TMUX_CONF = path.join(os.homedir(), '.tmux.conf'); ... L63: const raw = fs.readFileSync(TMUX_CONFIG_FILE, 'utf-8'); L64: const parsed = JSON.parse(raw); L65: return { ... L81: try { L82: const out = (0, exec_1.execFileSync)('tmux', ['-V'], { encoding: 'utf-8', timeout: 5000 }).trim(); L83: installed = true; ... L139: } L140: const inTmuxSession = !!process.env.TMUX; L141: return {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

core/scripts/memory-reconcile.jsView file

19const os = require('os'); L20: const http = require('http'); L21: const { loopbackAuthHeader } = require('./lib/loopback-auth'); L22: const { execFileSync } = require('child_process'); L23: L24: const PORT = process.env.API_PORT || (__dirname.includes('node_modules') ? '3100' : '3200'); L25: const MAP_SCRIPT = path.join(__dirname, 'memory-map.js');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/scripts/memory-reconcile.jsView on unpkg · L19

bin/lm-assist.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 79

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 74-104json

74 "pidtree": "^0.6.0",

75 "puppeteer-core": "24.43.1",

76 "selfsigned": "^2.4.1",

77 "tree-kill": "^1.2.2",

78 "uuid": "^9.0.0",

79 "ws": "^8.18.0"

80 },

81 "workspaces": [

82 "core",

83 "web"

84 ],

85 "scripts": {

86 "build:core": "cd core && npm run build",

87 "build:web": "cd web && npm run build",

88 "build": "npm run build:core && npm run build:web",

89 "start": "node bin/lm-assist.js start",

90 "stop": "node bin/lm-assist.js stop",

91 "restart": "node bin/lm-assist.js restart",

92 "prepublishOnly": "npm run build:core",

93 "prepare": "npm run build",

94 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L94

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L94

95 },

96 "overrides": {

97 "global-agent": "^4.1.2"

98 },

99 "publishConfig": {

100 "access": "public",

101 "registry": "https://registry.npmjs.org/"

102 }

103}

104

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

core/dist/service-manager.jsView file

Lines 38-78javascript

38 return result;

39 };

40})();

41Object.defineProperty(exports, "__esModule", { value: true });

42exports.startCore = startCore;

43exports.startWeb =

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

core/dist/routes/core/tmux.routes.jsView file

Lines 32-72javascript

32 var ar = [];

33 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

core/scripts/memory-reconcile.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * memory-reconcile.js -- Stream A reconciliation tier: dedup/merge + dependency

4 * mapping + outdated/superseded detection.

5 *

6 * PLAN-DEFAULT: writes a plan to ~/.lm-assist/memory-reconcile-plan.jsonl.

7 * NEVER auto-deletes, auto-merges, or auto-edits memory files.

8 * NEVER git-commits unless --apply AND MEMORY_RECONCILE_APPLY=on are BOTH set.

9 *

10 * Spec: docs/plans/2026-06-06-record-level-memory-map-and-sync.md sec 9, 12, 13.

bin/lm-assist.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 79

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

lm-assist@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code