Loading npm security reports…

novahiz@0.2.5: AI-agent control-surface risk | LPM Firewall

registry / novahiz / 0.2.5

novahiz@0.2.5

Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic post-install installer changes the user's OpenCode environment and installs additional global packages. It enables local MCP commands and plugins through a generated OpenCode configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the postinstall hook.

Impact

Installing this package can alter a broad AI-agent control surface and activate third-party tools without an explicit user setup action.

Mechanism

The installer runs with the affirmative flag, invokes global npm installs, and writes OpenCode configuration and plugin settings.

Policy narrative

During npm installation, the postinstall hook invokes the installer with automatic confirmation. The installer may globally install OpenCode, MCP servers, and OpenCode plugins, then creates configuration enabling local MCP commands and plugins. These changes occur without an explicit user-command setup step and affect the user's AI-agent environment.

AI rationale

The automatic postinstall hook performs unconsented mutation of a broad AI-agent control surface, including global package installation and enabled agent configuration. This meets the install-control-surface blocking rule.

Evidence

package.jsoninstall/install.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install/install.mjs --yes

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install/install.mjs --yes

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install/lib.mjsView file

3import { dirname, join, resolve } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

install/lib.mjsView on unpkg · L3

bin/novahiz.mjsView file

6const cli = join(here, "..", "src", "cli.ts"); L7: await import(pathToFileURL(cli).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/novahiz.mjsView on unpkg · L6

install/install.mjsView file

1import { cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs"; L2: import { homedir } from "node:os"; ... L72: const home = NovahizHome(flags); L73: const configDir = flags.scope === "project" ? resolve(".opencode") : opencodeConfigDir(); L74: const skillsDir = join(configDir, "skills"); ... L143: note(`Copying core to ${home}`); L144: if (!dryRun) mkdirSync(home, { recursive: true }); L145: for (const item of CORE_ITEMS) { ... L168: if (existsSync(skillsSource)) { L169: const externalRoots = [join(homedir(), ".agents", "skills")]; L170: const alreadyInstalled = skillNamesIn(externalRoots); ... L248: const backup = `${configPath}.novahiz-bak`;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install/install.mjsView on unpkg · L1

3import { join, resolve } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { ... L32: "docs", L33: "package.json", L34: "tsconfig.json", ... L76: L77: const note = (message) => process.stdout.write(`${dryRun ? "[dry-run] " : ""}${message}\n`); L78: ... L168: if (existsSync(skillsSource)) { L169: const externalRoots = [join(homedir(), ".agents", "skills")]; L170: const alreadyInstalled = skillNamesIn(externalRoots);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install/install.mjsView on unpkg · L3

89if (dryRun) { L90: note("opencode not detected. Would install globally (npm install -g opencode-ai)."); L91: } else { L92: note("opencode not detected. Global installation..."); L93: const installResult = spawnSync("npm", ["install", "-g", "opencode-ai"], { L94: encoding: "utf8",

install/install.shView file

•path = install/install.sh kind = build_helper sizeBytes = 124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/install.shView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 32-72json

32 "novahiz-install": "install/install.mjs",

33 "novahiz-uninstall": "install/uninstall.mjs",

34 "novahiz-mcp": "mcp/novahiz-tools/index.mjs"

35 },

36 "engines": {

37 "node": ">=22.18.0"

38 },

39 "scripts": {

40 "check": "node --experimental-strip-types src/cli.ts check",

41 "sync": "node --experimental-strip-types src/cli.ts sync",

42 "classify": "node --experimental-strip-types src/cli.ts classify",

43 "catalog": "node --experimental-strip-types src/cli.ts catalog",

44 "report": "node --experimental-strip-types src/cli.ts report",

45 "setup": "node install/install.mjs",

46 "setup:dry": "node install/install.mjs --dry-run",

47 "bootstrap": "node install/bootstrap.mjs",

48 "bootstrap:dry": "node install/bootstrap.mjs --dry-run",

49 "test": "node --experimental-strip-types --test",

50 "typecheck": "tsc --noEmit",

51 "prepare": "tsc --noEmit",

52 "postinstall": "node install/install.mjs --yes"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 },

54 "files": [

55 "src",

56 "catalog",

57 "adapters",

58 "bin",

59 "install",

60 "mcp",

61 "skills",

62 "docs",

63 "README.md",

64 "NOTICE.md",

65 "novahiz.config.example.json",

66 "tsconfig.json",

67 "LICENSE"

68 ],

69 "devDependencies": {

70 "@opencode-ai/plugin": "1.18.30",

71 "@types/node": "24.13.4",

72 "typescript": "7.0.2"

install/lib.mjsView file

Lines 1-23javascript

1import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";

2import { homedir } from "node:os";

3import { dirname, join, resolve } from "node:path";

4import { spawnSync } from "node:child_process";

bin/novahiz.mjsView file

Lines 1-8javascript

1#!/usr/bin/env node

2import { dirname, join } from "node:path";

3import { fileURLToPath, pathToFileURL } from "node:url";

4

5const here = dirname(fileURLToPath(

install/install.mjsView file

Lines 1-23javascript

1import { cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs";

2import { homedir } from "node:os";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install/install.mjsView on unpkg · L1

3import { join, resolve } from "node:path";

install/install.shView file

•path = install/install.sh kind = build_helper sizeBytes = 124 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/install.shView on unpkg