Loading npm security reports…

pantheon-cli@0.2.128: AI-agent control-surface risk | LPM Firewall

registry / pantheon-cli / 0.2.128

pantheon-cli@0.2.128

Carry agent conscience between AI coding agents. Hand off a conversation in one agent, resume it in another.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically alters several unrelated AI-agent control surfaces. It registers a Pantheon MCP server and writes command and skill instructions that can direct agents to send conversation content and attachments to Pantheon tools.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Global installation of the package activates postinstall.

Impact

Cursor, Claude, Codex, ChatGPT, and Windsurf may load a package-controlled MCP command and behavioral instructions without an explicit setup command.

Mechanism

Automatic cross-agent MCP configuration and prompt-file injection.

Policy narrative

Installing this package globally runs its postinstall hook, which invokes the bundled CLI without a separate user setup action. The CLI installs MCP entries across multiple third-party AI clients and creates agent command and skill files. Those files direct agents to make Pantheon tool calls and, on fallback, provide visible conversation turns and attachments. This is an unconsented, broad AI-agent control-surface mutation initiated by package installation.

AI rationale

The automatic global lifecycle chain modifies foreign AI-agent configurations and injects instructions that can cause conversation and attachment transfer. This meets the install-hook abuse policy regardless of the global-install guard.

Evidence

package.jsonpostinstall.mjsdist/pantheon.mjs~/.cursor/mcp.json~/.claude.json~/.codex/config.toml~/Library/Application Support/Claude/claude_desktop_config.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/pantheon.mjsView file

39839lstatSync, L39840: mkdirSync as mkdirSync2, L39841: openSync as openSync2, ... L39847: statSync as statSync2, L39848: writeFileSync as writeFileSync2, L39849: appendFileSync L39850: } from "node:fs"; ... L39866: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39867: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39868: const reported = client?.trim(); ... L40020: function codexRoot() { L40021: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39839

39850} from "node:fs"; L39851: import { execFileSync, spawnSync } from "node:child_process"; L39852: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39850

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.124 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.124 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 99027ba632474ae0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pantheon-cli@0.2.124 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.124 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/pantheon.mjsView on unpkg

2953sourceCode = this.opts.code.process(sourceCode, sch); L2954: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2955: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pantheon.mjsView on unpkg · L2953

postinstall.mjsView file

1Cross-file remote execution chain: postinstall.mjs spawns dist/pantheon.mjs; helper contains network access plus dynamic code execution. L1: import { spawnSync } from "node:child_process"; L2: import { fileURLToPath } from "node:url"; ... L4: const globalInstall = ["1", "true"].includes( L5: (process.env.npm[redacted] || "").toLowerCase(), L6: ); ... L16: if (result.error) { L17: process.stderr.write( L18: `pantheon: installed, but automatic agent refresh could not start — ${result.error.message}\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

postinstall.mjsView on unpkg · L1

Source & flagged code

8 flagged

package.jsonView file

Lines 21-43json

21 "handoff",

22 "cursor",

23 "claude",

24 "codex"

25 ],

26 "dependencies": {},

27 "devDependencies": {

28 "@modelcontextprotocol/sdk": "^1.12.1",

29 "@types/node": "^20",

30 "esbuild": "^0.28.2",

31 "tsx": "^4.20.3",

32 "typescript": "^5",

33 "zod": "^3.25.67",

34 "@pantheon/core": "0.1.0",

35 "@pantheon/mcp": "0.1.0"

36 },

37 "scripts": {

38 "start": "tsx src/index.ts",

39 "test": "tsx --test test/*.test.ts",

40 "build": "node scripts/build.mjs",

41 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 }

43}

dist/pantheon.mjsView file

39839lstatSync, L39840: mkdirSync as mkdirSync2, L39841: openSync as openSync2, ... L39847: statSync as statSync2, L39848: writeFileSync as writeFileSync2, L39849: appendFileSync L39850: } from "node:fs"; ... L39866: var UNREADABLE_CLIENTS = /claude[-_. ]?(ai|desktop)|windsurf|replit|grok[-_. ]?bot|continue|cline/i; L39867: function resolveCaptureClient(client, claudeProjectDir = process.env.CLAUDE_PROJECT_DIR) { L39868: const reported = client?.trim(); ... L40020: function codexRoot() { L40021: return join(homedir(), ".codex", "sessions");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/pantheon.mjsView on unpkg · L39839

39850} from "node:fs"; L39851: import { execFileSync, spawnSync } from "node:child_process"; L39852: import { homedir as homedir2 } from "node:os";

High

Child Process

Package source references child process execution.

dist/pantheon.mjsView on unpkg · L39850

•matchType = normalized_sha256 matchedPackage = pantheon-cli@0.2.124 matchedPath = dist/pantheon.mjs matchedIdentity = npm:cGFudGhlb24tY2xp:0.2.124 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/pantheon.mjsView on unpkg

postinstall.mjsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { fileURLToPath } from "node:url";

3

4const globalInstall = ["1", "true"].includes(