Loading npm security reports…

pantheon-cli: AI-agent control-surface risk | LPM Firewall

registry / pantheon-cli / 0.2.130

pantheon-cli@0.2.130

Carry agent conscience between AI coding agents. Hand off a conversation in one agent, resume it in another.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically rewrites several foreign AI-agent control files in the user home directory. Slash commands and a Pantheon skill are written even when the user has never connected an account. If a machine config exists, MCP server entries are merged into Cursor, Claude, Codex, and related clients.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during a global install, when npm_config_global is true.

Impact

Agents such as Cursor, Claude Code, and Codex gain Pantheon commands, skills, and an MCP server without a separate user command such as pantheon mcp-install.

Mechanism

postinstall.mjs spawns dist/pantheon.mjs _postinstall, which calls installAfterGlobalUpdate. That writes ~/.cursor and ~/.claude command files and Pantheon skills, and when connected calls installMcpClients to merge a local stdio MCP server into agent config files.

Policy narrative

On a global npm install, postinstall.mjs launches the package CLI with _postinstall. That path calls installAfterGlobalUpdate, which writes Pantheon slash commands into ~/.cursor/commands and ~/.claude/commands and a skill into ~/.agents and ~/.codex even if the user never paired an account. When a machine config is already present, it also merges a Pantheon stdio MCP server into Cursor, Claude Code, Claude Desktop, Codex, and Windsurf configs. The user did not run the explicit mcp-install command.

AI rationale

Global postinstall unconditionally mutates foreign, broad agent control surfaces, including Cursor, Claude, and Codex config, command, and skill files. That is unconsented install-time agent control-surface mutation, not a user-invoked setup command.

Evidence

package.jsonpostinstall.mjs

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pantheon.mjsView file

40234lstatSync, L40235: mkdirSync as mkdirSync2, L40236: openSync as openSync2, ... L40242: statSync as statSync2, L40243: writeFileSync as writeFileSync2, L40244: appendFileSync L40245: } from "node:fs"; ... L40261: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L40262: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L40263: const reported = client?.trim(); ... L40415: function codexRoot() { L40416: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L40234

40245} from "node:fs"; L40246: import { execFileSync, spawnSync } from "node:child_process"; L40247: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L40245

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.121 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.121 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 99027ba632474ae0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pantheon-cli@0.2.121 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.121 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/pantheon.mjsView on unpkg

2953sourceCode = this.opts.code.process(sourceCode, sch); L2954: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2955: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pantheon.mjsView on unpkg · L2953

postinstall.mjsView file

1Cross-file remote execution chain: postinstall.mjs spawns dist/pantheon.mjs; helper contains network access plus dynamic code execution. L1: import { spawnSync } from "node:child_process"; L2: import { fileURLToPath } from "node:url"; ... L4: const globalInstall = ["1", "true"].includes( L5: (process.env.npm[redacted] || "").toLowerCase(), L6: ); ... L16: if (result.error) { L17: process.stderr.write( L18: `pantheon: installed, but automatic agent refresh could not start — ${result.error.message}\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

postinstall.mjsView on unpkg · L1