Loading npm security reports…

novahiz: AI-agent control-surface risk | LPM Firewall

registry / novahiz / 0.5.2

novahiz@0.5.2

Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation modifies OpenCode's user-wide agent control surface without interactive consent. Installed plugins alter system context and tool execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation with postinstall scripts enabled.

Impact

Subsequent OpenCode sessions receive package-defined enforcement instructions and tool gates across projects.

Mechanism

The postinstall hook supplies --yes, bypasses confirmation, and copies executable plugins and agent resources into OpenCode's configuration directories.

Policy narrative

The published postinstall hook invokes the installer with --yes rather than --dry-run. This suppresses its confirmation prompt and activates writes to OpenCode's user-wide configuration, including plugins, skills, agent instructions, and commands. The copied plugin injects enforcement text into system context and intercepts tool execution. Backups and home-directory restrictions do not provide consent for modifying this foreign agent control surface.

AI rationale

Inspected source establishes unconsented postinstall mutation of OpenCode's user-wide agent control surface. This meets the blocking policy independently of scanner similarity labels or citation limits.

Evidence

package.jsoninstall/install.mjsinstall/lib.mjsadapters/opencode/novahiz-plugin.ts.config/opencodenovahiz-plugin.tsnovahiz-token-economy.ts

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node install/install.mjs --yes || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/install.mjs --yes || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/novahiz.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = bin/novahiz.mjs matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/novahiz.mjsView on unpkg

64L65: await import(pathToFileURL(target).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/novahiz.mjsView on unpkg · L64

install/bootstrap.mjsView file

5import { join, resolve } from "node:path"; L6: import { spawnSync } from "node:child_process"; L7: import { fileURLToPath } from "node:url"; ... L9: L10: const REPO_URL = "https://github.com/novahiz/novahiz.git"; L11: // Was hardcoded to ~/.config/novahiz, ignoring NOVAHIZ_HOME/NOVAHIZ_HOME. ... L15: function log(msg) { L16: process.stdout.write(`[Novahiz] ${msg}\n`); L17: } ... L24: // ENOENT (post-CVE-2024-* Node refuses to run .cmd via CreateProcess). The L25: // line handed to cmd.exe only contains tokens accepted by unsafeHostToken L26: // (lib.mjs — the install-side mirror of src/exec.ts SAFE_TOKEN, widened by

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install/bootstrap.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = install/bootstrap.mjs matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install/bootstrap.mjsView on unpkg

install/install.mjsView file

1#!/usr/bin/env node L2: import { cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs"; L3: import { homedir } from "node:os"; ... L53: const home = NovahizHome(flags); L54: const configDir = flags.scope === "project" ? resolve(".opencode") : opencodeConfigDir(); L55: const skillsDir = join(configDir, "skills"); ... L160: for (const name of configured) { L161: if (!existsSync(harnessDirs[name])) mkdirSync(harnessDirs[name], { recursive: true }); L162: } ... L172: note(`Copying core to ${home}`); L173: if (!dryRun) mkdirSync(home, { recursive: true }); L174: for (const item of CORE_ITEMS) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install/install.mjsView on unpkg · L1

install/install.shView file

•path = install/install.sh kind = build_helper sizeBytes = 124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/install.shView on unpkg

mcp/argus/src/fixtures/test_vulnerable.pyView file

•path = mcp/argus/src/fixtures/test_vulnerable.py kind = payload_in_excluded_dir sizeBytes = 451 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

mcp/argus/src/fixtures/test_vulnerable.pyView on unpkg

dist/commands/memory.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/memory.js#virtual:normalized:round1View on unpkg

adapters/opencode/novahiz-plugin.tsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = adapters/opencode/novahiz-plugin.ts matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

adapters/opencode/novahiz-plugin.tsView on unpkg

dist/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = dist/commands/doctor.js matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/doctor.jsView on unpkg

src/commands/doctor.tsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = src/commands/doctor.ts matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/doctor.tsView on unpkg

mcp/argus/src/commands/test.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = mcp/argus/src/commands/test.mjs matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/argus/src/commands/test.mjsView on unpkg

mcp/clepsydre/src/executors.tsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = mcp/clepsydre/src/executors.ts matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/clepsydre/src/executors.tsView on unpkg

skills/llm-threat-review/scripts/llm_risk_lint.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = skills/llm-threat-review/scripts/llm_risk_lint.mjs matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/llm-threat-review/scripts/llm_risk_lint.mjsView on unpkg

dist/commands/second-memory.jsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = dist/commands/second-memory.js matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/second-memory.jsView on unpkg

skills/secrets-hygiene/scripts/secret_scan.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = skills/secrets-hygiene/scripts/secret_scan.mjs matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/secrets-hygiene/scripts/secret_scan.mjsView on unpkg

skills/skill-authoring/scripts/skill_frontmatter_lint.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = skills/sk[redacted]/scripts/sk[redacted] matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/skill-authoring/scripts/skill_frontmatter_lint.mjsView on unpkg

skills/skill-eval-loop/scripts/skill_structure_check.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.4.1 matchedPath = skills/sk[redacted]/scripts/sk[redacted] matchedIdentity = npm:bm92YWhpeg:0.4.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/skill-eval-loop/scripts/skill_structure_check.mjsView on unpkg