Loading npm security reports…

mandrel@2.69.0: Suspicious npm security report (Warn) | LPM Firewall

registry / mandrel / 2.69.0

mandrel@2.69.0

Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installing mandrel runs a postinstall hook that copies this package's own .agents instruction, skill, and workflow tree into the consumer project and may set a local git merge driver. No credential send, remote payload, or write to a foreign agent settings file was found on that path.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install lifecycle postinstall, unless the install is inside the mandrel source checkout.

Impact

The consumer project receives this package's agent instructions and workflows without a separate confirmation step. Interactive GitHub bootstrap and Claude command projection stay behind later commands.

Mechanism

bin/postinstall.js calls lib/cli/sync.js, which copies package .agents files onto the consumer ./.agents directory, prunes unmatched managed files, and optionally records a git merge driver.

AI rationale

The install hook materializes this package's own agent payload into the consumer project, which is first-party agent setup rather than a hidden foreign control-surface takeover. No exfiltration, remote execution, or self-install chain was found, so the automatic install write warrants a warning.

Evidence

package.jsonbin/postinstall.jslib/cli/sync.js.agents/merge.mandrel-baseline.driver

Decision evidence

public snapshot

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js mandrel sync

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js mandrel sync

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.agents/scripts/lib/qa/redact-evidence.jsView file

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

.agents/scripts/lib/qa/redact-evidence.jsView on unpkg · L17

bin/mandrel.jsView file

101function installedVersion() { L102: const req = createRequire(import.meta.url); L103: const manifest = req('../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/mandrel.jsView on unpkg · L101

bin/postinstall.jsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: #!/usr/bin/env node L2: // bin/postinstall.js — best-effort `.agents/` materializer on install. L3: ... L7: * doctor-detected "not materialized" state instead of failing the install. L8: * In the framework's own source checkout it no-ops, since `.agents/` there is L9: * the committed product and a sync would clobber it. ... L19: const HINT = L20: 'mandrel: could not materialize ./.agents/ during install — run `mandrel sync` to finish setup.\n'; L21: Referenced control path from bin/postinstall.js: L1: #!/usr/bin/env node L2: // bin/postinstall.js — best-effort `.agents/` materializer on install. L3: ... L7: * doctor-detected "not materialized" state instead of failing the ins

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.jsView on unpkg · L1

lib/cli/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/cli/init.js#virtual:normalized:round1View on unpkg

lib/cli/update.jsView file

•matchType = normalized_sha256 matchedPackage = mandrel@2.60.0 matchedPath = lib/cli/update.js matchedIdentity = npm:bWFuZHJlbA:2.60.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli/update.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 51-91json

51 "cyclomatic:update": "node .agents/scripts/check-cyclomatic.js --update",

52 "dead-exports:update": "node scripts/update-dead-exports-baseline.js && node scripts/update-dead-exports-baseline.js --production",

53 "check:knip-entries": "node scripts/check-knip-entries.js",

54 "validator:gen": "node scripts/check-generated-validator.js",

55 "validator:check": "node scripts/check-generated-validator.js --check",

56 "config:ceiling": "node scripts/check-agentrc-key-ceiling.js",

57 "check:comment-policy": "node scripts/check-comment-policy.js",

58 "check:schema-refs": "node scripts/check-schema-references.js",

59 "check:workflow-citations": "node scripts/check-workflow-citations.js",

60 "crap:check": "node .agents/scripts/check-baselines.js --gate crap",

61 "crap:update": "node .agents/scripts/update-crap-baseline.js",

62 "crap:reanchor": "node .agents/scripts/update-crap-baseline.js --full-scope",

63 "duplication:check": "node .agents/scripts/check-baselines.js --gate duplication",

64 "duplication:update": "node .agents/scripts/update-duplication-baseline.js",

65 "duplication:reanchor": "node .agents/scripts/update-duplication-baseline.js --full-scope",

66 "quality:preview": "node .agents/scripts/check-dead-exports.js && node .agents/scripts/quality-preview.js",

67 "quality:watch": "node .agents/scripts/quality-watch.js",

68 "sync:commands": "node bin/mandrel.js sync-commands",

69 "sync:agents": "node .agents/scripts/sync-claude-agents.js",

70 "prepare": "husky && npm run sync:commands && npm run sync:agents && npm run baselines:merge-driver",

71 "postinstall": "node bin/postinstall.js mandrel sync"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 },

73 "repository": {

74 "type": "git",

75 "url": "git+https://github.com/dsj1984/mandrel.git"

76 },

77 "keywords": [

78 "claude-code",

79 "ai-agents",

80 "sdlc",

81 "workflow",

82 "orchestration",

83 "agentic"

84 ],

85 "author": "",

86 "license": "MIT",

87 "bin": {

88 "mandrel": "./bin/mandrel.js"

89 },

90 "type": "module",

91 "bugs": {

.agents/scripts/lib/qa/redact-evidence.jsView file

Lines 1-37javascript

1/**

2 * redact-evidence.js — deterministic secrets/PII scrubber run before QA

3 * evidence is persisted or posted (security baseline § Data Leakage).

4 * Idempotent (placeholders match no rule) and pass-through for benign text.

5 */

6

7/**

8 * Per-rule placeholders, free of anything a pattern matches (`@`, `=`, long

9 * token or digit runs) so the pass is a fixed point.

10 *

11 *

bin/mandrel.jsView file

Lines 81-121javascript

81 ],

82 [

83 'explain',

84 {

85 description: 'print resolved config values and their sources',

86 knownFlags: new Set(['--json']),

87 },

88 ],

bin/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// bin/postinstall.js — best-effort `.agents/` materializer on install.

3

4/**

5 * Runs `mandrel sync` on install. Best-effort by contract: always exits 0 so

6 * `--ignore-scripts`, sandboxed CI, or a copy error degrade to the

7 * doctor-detected "not materialized" state instead of failing the install.

8 * In the framework's own source checkout it no-ops, since `.agents/` there is

9 * the committed product and a sync would clobber it.

10 */

11

lib/cli/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/cli/init.js#virtual:normalized:round1View on unpkg

lib/cli/update.jsView file

•matchType = normalized_sha256 matchedPackage = mandrel@2.60.0 matchedPath = lib/cli/update.js matchedIdentity = npm:bWFuZHJlbA:2.60.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cli/update.jsView on unpkg