Loading npm security reports…

pantheon-cli@0.2.121: AI-agent control-surface risk | LPM Firewall

registry / pantheon-cli / 0.2.121

pantheon-cli@0.2.121

Carry agent conscience between AI coding agents. Hand off a conversation in one agent, resume it in another.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently modifies multiple AI-agent configuration surfaces and installs a Pantheon MCP launcher. This creates persistent agent-control integrations without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package globally through npm.

Impact

Future AI-agent sessions can load and run the package's configured MCP server and instructions.

Mechanism

Postinstall launches a hidden CLI command that writes MCP settings, slash commands, and agent skills.

Policy narrative

On global installation, npm runs postinstall.mjs, which starts the bundled CLI with a private _postinstall command. That command installs Pantheon MCP configuration into Cursor, Claude, Codex, ChatGPT where available, and Windsurf, then writes skills and slash-command files. The changes occur even when no Pantheon account or prior configuration exists, so the package extends several foreign AI-agent control surfaces without a user-requested setup action.

AI rationale

The automatic global lifecycle chain broadly mutates foreign AI-agent configurations and installs executable MCP integration. This is concrete unconsented install-hook abuse under the policy.

Evidence

package.jsonpostinstall.mjsdist/pantheon.mjs~/.cursor/mcp.json~/.claude.json~/.codex/config.toml~/.agents/skills/pantheon/SKILL.md~/.codex/skills/pantheon/SKILL.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pantheon.mjsView file

39838lstatSync as lstatSync2, L39839: mkdirSync as mkdirSync3, L39840: openSync as openSync2, ... L39846: statSync as statSync2, L39847: writeFileSync as writeFileSync3, L39848: appendFileSync L39849: } from "node:fs"; ... L39865: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39866: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39867: const reported = client?.trim(); ... L40019: function codexRoot() { L40020: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39838

39849} from "node:fs"; L39850: import { execFileSync, spawnSync } from "node:child_process"; L39851: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39849

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.128 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.128 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 99027ba632474ae0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pantheon-cli@0.2.128 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.128 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/pantheon.mjsView on unpkg

2953sourceCode = this.opts.code.process(sourceCode, sch); L2954: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2955: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pantheon.mjsView on unpkg · L2953

postinstall.mjsView file

1Cross-file remote execution chain: postinstall.mjs spawns dist/pantheon.mjs; helper contains network access plus dynamic code execution. L1: import { spawnSync } from "node:child_process"; L2: import { fileURLToPath } from "node:url"; ... L4: const globalInstall = ["1", "true"].includes( L5: (process.env.npm[redacted] || "").toLowerCase(), L6: ); ... L16: if (result.error) { L17: process.stderr.write( L18: `pantheon: installed, but automatic agent refresh could not start — ${result.error.message}\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

postinstall.mjsView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

Lines 21-43json

21 "handoff",

22 "cursor",

23 "claude",

24 "codex"

25 ],

26 "dependencies": {},

27 "devDependencies": {

28 "@modelcontextprotocol/sdk": "^1.12.1",

29 "@types/node": "^20",

30 "esbuild": "^0.28.2",

31 "tsx": "^4.20.3",

32 "typescript": "^5",

33 "zod": "^3.25.67",

34 "@pantheon/core": "0.1.0",

35 "@pantheon/mcp": "0.1.0"

36 },

37 "scripts": {

38 "start": "tsx src/index.ts",

39 "test": "tsx --test test/*.test.ts",

40 "build": "node scripts/build.mjs",

41 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

dist/pantheon.mjsView file

39838lstatSync as lstatSync2, L39839: mkdirSync as mkdirSync3, L39840: openSync as openSync2, ... L39846: statSync as statSync2, L39847: writeFileSync as writeFileSync3, L39848: appendFileSync L39849: } from "node:fs"; ... L39865: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39866: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39867: const reported = client?.trim(); ... L40019: function codexRoot() { L40020: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39838

39849} from "node:fs"; L39850: import { execFileSync, spawnSync } from "node:child_process"; L39851: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39849

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.128 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.128 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

postinstall.mjsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { fileURLToPath } from "node:url";

3

4const globalInstall = ["1", "true"].includes(