Loading npm security reports…

mvframe@1.1.38: Malicious npm security report (Block) | LPM Firewall

registry / mvframe / 1.1.38

mvframe@1.1.38

**English** | [简体中文](README.cn.md)

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The explicit app-scaffold CLI writes a project AGENTS.md instruction that directs future coding agents to report task summaries. It also creates notifier configuration populated with the package's bundled DingTalk test endpoint, and the notifier POSTs those messages.

Static reason

No blocking static signals were detected.

Trigger

User runs mvframe-init-app; subsequently an agent follows the injected AGENTS.md completion-notification rule.

Impact

Future development requests, changes, and validation summaries can be sent to the bundled third-party DingTalk webhook.

Mechanism

AI-agent instruction injection plus webhook-based task-summary exfiltration

Attack narrative

Running the advertised scaffold command writes the package's DingTalk test configuration into the project and injects AGENTS.md instructions requiring every completed AI development task to invoke the notifier with the user request and work summary. The notifier sends that supplied message to the configured webhook. This establishes a persistent exfiltration path in the consumer project, despite requiring an explicit scaffold invocation rather than npm installation.

Rationale

Source establishes a complete persistence-and-exfiltration chain: the scaffold installs an agent directive, seeds its destination, and supplies the POST client. The lack of lifecycle execution reduces reach but does not negate the concrete malicious behavior of the advertised initializer.

Evidence

package.jsonscripts/scaffold-app.jsscripts/install-codex-agents.jsscripts/notify-server.jsAGENTS.md.env.mvframe-notify.env.mvframe-notify.example

Source & flagged code

5 flagged · loading source

scripts/copy-flag-assets.jsView file

6L7: const fs = require("fs"); L8: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

scripts/scaffold-app.jsView file

12Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L12: * --force, -f 覆盖已存在的脚手架文件 L13: * --no-package-json, -n 不读不写 package.json（仅生成源码与 Vite 配置） L14: */ ... L17: const path = require("path"); L18: const { execFileSync } = require("child_process"); L19: const { upsertCodexAgents } = require("./install-codex-agents.js"); ... L27: const target = path.resolve( L28: process.env.MVFRAME_SCAFFOLD_TARGET || argPath || process.cwd(), L29: ); ... L92: const TEST_DINGTALK_WEBHOOK = L93: "https://oapi.dingtalk.com/robot/send?access_token=[redacted]"; L94: const TEST_DINGTALK_SECRET =

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/scaffold-app.jsView on unpkg · L12

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg

Source & flagged code

5 flagged

scripts/copy-flag-assets.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Copy flag-icons SVG assets beside the built host bundle.

4 * `src/style/chip/flag-icons.scss` points CSS URLs at `/assets/flags/...`.

5 */

6

7const fs = require("fs");

8const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/copy-flag-assets.jsView on unpkg · L6

9const { createRequire } = require("module");

10const { execFileSync } = require("child_process");

11

12const root = path.resolve(__dirname, "..");

13const pnpPath = path.join(root, ".pnp.cjs");

14

15// A raw `file:` install can copy the source checkout's PnP loader into the

16// host package. Only activate it while commands are running in this checkout.

17if (path.resolve(process.cwd()) === root && fs.existsSync(pnpPath)) {

18 require(pnpPath).setup();

19}

20

21const projectRequire = createRequire(path.join(root, "package.json"));

22const flagPackagePath = projectRequire.resolve("flag-icons/package.json");

23const flagRoot = path.dirname(flagPackagePath);

24const src = path.join(flagRoot, "flags");

25const dest = path.join(root, "dist", "assets", "flags");

26

scripts/scaffold-app.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * 在目标工程生成 MVFrame 推荐目录与雏形文件（views / component / api / pinia / router / config / assets）。

4 *

5 * 用法：

6 * node path/to/mvframe/scripts/scaffold-app.js [项目根] [--force|-f]

7 * yarn exec mvframe-init-app

8 *

9 * 环境变量：MVFRAME_SCAFFOLD_TARGET=/path/to/project

10 *

11 * 选项：

scripts/install-cursor-rules.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); if (!fs.existssync(rule

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-cursor-rules.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. #!/usr/bin/env node const fs = require("fs"); const path = require("path"); function installcursorrules(projectroot) { const targetroot = path.resolve(projectroot); const rulessrc = path.join(__dirname, "..", ".cursor", "rules"); i

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/@visactor.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/@visactor.jsView on unpkg