Loading npm security reports…

pantheon-cli@0.2.124: AI-agent control-surface risk | LPM Firewall

registry / pantheon-cli / 0.2.124

pantheon-cli@0.2.124

Carry agent conscience between AI coding agents. Hand off a conversation in one agent, resume it in another.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically modifies broad AI-agent control surfaces. It installs agent instructions and commands even when no prior Pantheon connection exists; connected installs also add MCP server entries.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Global npm installation runs the postinstall hook.

Impact

Cursor, Claude, Codex, and other supported agents can be persistently instructed to use Pantheon tools and launch its MCP server.

Mechanism

Automatic writes to third-party agent skills, commands, and MCP configuration.

Policy narrative

On global installation, npm runs postinstall.mjs, which starts the bundled CLI with an internal postinstall command. That command writes Pantheon skill files into generic and Codex agent directories and command files into Cursor and Claude directories without an explicit setup command. If existing Pantheon state is found, it also modifies third-party MCP configuration files to register the Pantheon server. The dropped skill broadly directs agents to call Pantheon MCP tools.

AI rationale

The package uses an automatic install lifecycle to mutate foreign, broad AI-agent control surfaces and inject persistent agent instructions. This is concrete install-hook abuse under the stated policy.

Evidence

postinstall.mjsdist/pantheon.mjs~/.agents/skills/pantheon/SKILL.md~/.codex/skills/pantheon/SKILL.md~/.cursor/commands/*.md~/.claude/commands/*.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pantheon.mjsView file

39838lstatSync, L39839: mkdirSync as mkdirSync2, L39840: openSync as openSync2, ... L39846: statSync as statSync2, L39847: writeFileSync as writeFileSync2, L39848: appendFileSync L39849: } from "node:fs"; ... L39865: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39866: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39867: const reported = client?.trim(); ... L40019: function codexRoot() { L40020: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39838

39849} from "node:fs"; L39850: import { execFileSync, spawnSync } from "node:child_process"; L39851: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39849

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.123 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.123 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 99027ba632474ae0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pantheon-cli@0.2.123 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.123 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/pantheon.mjsView on unpkg

2953sourceCode = this.opts.code.process(sourceCode, sch); L2954: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2955: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pantheon.mjsView on unpkg · L2953

postinstall.mjsView file

1Cross-file remote execution chain: postinstall.mjs spawns dist/pantheon.mjs; helper contains network access plus dynamic code execution. L1: import { spawnSync } from "node:child_process"; L2: import { fileURLToPath } from "node:url"; ... L4: const globalInstall = ["1", "true"].includes( L5: (process.env.npm[redacted] || "").toLowerCase(), L6: ); ... L16: if (result.error) { L17: process.stderr.write( L18: `pantheon: installed, but automatic agent refresh could not start — ${result.error.message}\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

postinstall.mjsView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

Lines 21-43json

21 "handoff",

22 "cursor",

23 "claude",

24 "codex"

25 ],

26 "dependencies": {},

27 "devDependencies": {

28 "@modelcontextprotocol/sdk": "^1.12.1",

29 "@types/node": "^20",

30 "esbuild": "^0.28.2",

31 "tsx": "^4.20.3",

32 "typescript": "^5",

33 "zod": "^3.25.67",

34 "@pantheon/core": "0.1.0",

35 "@pantheon/mcp": "0.1.0"

36 },

37 "scripts": {

38 "start": "tsx src/index.ts",

39 "test": "tsx --test test/*.test.ts",

40 "build": "node scripts/build.mjs",

41 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

dist/pantheon.mjsView file

39838lstatSync, L39839: mkdirSync as mkdirSync2, L39840: openSync as openSync2, ... L39846: statSync as statSync2, L39847: writeFileSync as writeFileSync2, L39848: appendFileSync L39849: } from "node:fs"; ... L39865: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39866: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39867: const reported = client?.trim(); ... L40019: function codexRoot() { L40020: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39838

39849} from "node:fs"; L39850: import { execFileSync, spawnSync } from "node:child_process"; L39851: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39849

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.123 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.123 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

postinstall.mjsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { fileURLToPath } from "node:url";

3

4const globalInstall = ["1", "true"].includes(