Loading npm security reports…

novahiz@0.2.3: AI-agent control-surface risk | LPM Firewall

registry / novahiz / 0.2.3

novahiz@0.2.3

Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing novahiz runs a postinstall script that mutates the user's OpenCode agent configuration and globally installs extra agent tooling without a consent prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall executes node install/install.mjs --yes.

Impact

A package install can change which plugins, skills, shell, and MCP servers a foreign coding agent loads, including a git-persisting local server and a remote Expo MCP endpoint.

Mechanism

The script installs opencode if absent, copies the Novahiz plugin, agent, and commands into the OpenCode config directory, globally npm-installs MCP servers and third-party plugins, and writes opencode.jsonc enabling those tools.

Policy narrative

On npm install, postinstall launches install/install.mjs with --yes. The script treats a missing opencode binary as a reason to npm install -g opencode, then copies this package's plugin, agent, and commands into the user OpenCode config directory. It also globally installs unrelated MCP packages and third-party OpenCode plugins and, when opencode.jsonc is absent, writes a config that enables those plugins plus narsil-mcp with git persistence, a cron MCP, Playwright, and https://mcp.expo.dev/mcp. The user never confirms this agent-control change.

AI rationale

The postinstall hook silently rewrites a foreign OpenCode control surface and installs extra global agent packages, which is unconsented agent-control mutation. Product-aligned plugin setup does not cover forcing third-party plugins and MCP servers during install.

Evidence

package.jsoninstall/install.mjsinstall/lib.mjs~/.config/opencode/plugins/novahiz.ts

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node install/install.mjs --yes

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/install.mjs --yes

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/novahiz.mjsView file

6const cli = join(here, "..", "src", "cli.ts"); L7: await import(pathToFileURL(cli).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/novahiz.mjsView on unpkg · L6

install/install.mjsView file

1import { cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs"; L2: import { homedir } from "node:os"; ... L73: const home = NovahizHome(flags); L74: const configDir = flags.scope === "project" ? resolve(".opencode") : opencodeConfigDir(); L75: const skillsDir = join(configDir, "skills"); ... L140: note(`Copying core to ${home}`); L141: if (!dryRun) mkdirSync(home, { recursive: true }); L142: for (const item of CORE_ITEMS) { ... L165: if (existsSync(skillsSource)) { L166: const externalRoots = [join(homedir(), ".agents", "skills")]; L167: const alreadyInstalled = skillNamesIn(externalRoots); ... L258: const backup = `${configPath}.novahiz-bak`;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install/install.mjsView on unpkg · L1

3import { join, resolve } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { ... L33: "docs", L34: "package.json", L35: "tsconfig.json", ... L77: L78: const note = (message) => process.stdout.write(`${dryRun ? "[dry-run] " : ""}${message}\n`); L79: ... L165: if (existsSync(skillsSource)) { L166: const externalRoots = [join(homedir(), ".agents", "skills")]; L167: const alreadyInstalled = skillNamesIn(externalRoots);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install/install.mjsView on unpkg · L3

install/install.shView file

•path = install/install.sh kind = build_helper sizeBytes = 124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/install.shView on unpkg

adapters/opencode/novahiz.tsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.2.5 matchedPath = adapters/opencode/novahiz.ts matchedIdentity = npm:bm92YWhpeg:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

adapters/opencode/novahiz.tsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = novahiz@0.3.1 matchedIdentity = npm:bm92YWhpeg:0.3.1 similarity = 0.453 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/opencode/novahiz.tsView on unpkg

bundled-skills/expo-skill-eval/scripts/snapshot-android.shView file

•matchType = normalized_sha256 matchedPackage = skillenforce@0.2.2 matchedPath = bundled-skills/expo-skill-eval/scripts/snapshot-android.sh matchedIdentity = npm:c2tpbGxlbmZvcmNl:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-skills/expo-skill-eval/scripts/snapshot-android.shView on unpkg

bundled-skills/expo-skill-eval/scripts/snapshot-ios.shView file

•matchType = normalized_sha256 matchedPackage = skillenforce@0.2.2 matchedPath = bundled-skills/expo-skill-eval/scripts/snapshot-ios.sh matchedIdentity = npm:c2tpbGxlbmZvcmNl:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-skills/expo-skill-eval/scripts/snapshot-ios.shView on unpkg

bundled-skills/expo-skill-feedback/scripts/skill-event.cjsView file

•matchType = normalized_sha256 matchedPackage = skillenforce@0.2.2 matchedPath = bundled-skills/expo-sk[redacted]/scripts/sk[redacted] matchedIdentity = npm:c2tpbGxlbmZvcmNl:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-skills/expo-skill-feedback/scripts/skill-event.cjsView on unpkg

install/bootstrap.mjsView file

•matchType = token_shingles matchedPackage = skillenforce@0.2.2 matchedPath = install/bootstrap.mjs matchedIdentity = npm:c2tpbGxlbmZvcmNl:0.2.2 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install/bootstrap.mjsView on unpkg

bundled-skills/expo-skill-feedback/scripts/telemetry_common.cjsView file

•matchType = normalized_sha256 matchedPackage = skillenforce@0.2.2 matchedPath = bundled-skills/expo-sk[redacted]/scripts/telemetry_common.cjs matchedIdentity = npm:c2tpbGxlbmZvcmNl:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-skills/expo-skill-feedback/scripts/telemetry_common.cjsView on unpkg

bundled-skills/expo-skill-eval/scripts/snapshot-web.shView file

•matchType = normalized_sha256 matchedPackage = skillenforce@0.2.2 matchedPath = bundled-skills/expo-skill-eval/scripts/snapshot-web.sh matchedIdentity = npm:c2tpbGxlbmZvcmNl:0.2.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundled-skills/expo-skill-eval/scripts/snapshot-web.shView on unpkg

mcp/novahiz-tools/index.mjsView file

•matchType = normalized_sha256 matchedPackage = novahiz@0.2.5 matchedPath = mcp/novahiz-tools/index.mjs matchedIdentity = npm:bm92YWhpeg:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/novahiz-tools/index.mjsView on unpkg