registry / peaks-loop / 3.1.1

peaks-loop@3.1.1

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The package performs unconsented install-time mutation of multiple AI-agent control surfaces. The behavior is package-aligned but broad and lifecycle-triggered, which is blockable under the firewall policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install/postinstall

Impact

Consumer home/project AI-agent behavior can be changed without an explicit CLI opt-in.

Mechanism

postinstall drops/symlinks AI-agent skills, output styles, agents, config, and auto-upgrade hooks

Attack narrative

Installing peaks-loop runs scripts/install-skills.mjs automatically. That script fans out bundled skills and agent prompts into user-home AI IDE directories for Claude, Codex, Cursor, Trae, Qoder, Tongyi Lingma and others, creates Peaks config, and can invoke an automatic project upgrade. These are foreign or broad AI-agent control surfaces modified during npm lifecycle execution without a separate user-invoked setup command.

Rationale

Direct source inspection confirms a postinstall lifecycle script that installs package-supplied instructions into multiple home-level AI-agent surfaces by default. Under the supplied install-control-surface policy, unconsented lifecycle delivery into foreign/broad agent control surfaces is malicious even when the content appears product-aligned.

Evidence

package.jsonscripts/install-skills.mjsskills/peaks-solo/SKILL.md.claude-plugin/marketplace.json~/.claude/skills/*~/.claude/output-styles/*~/.claude/agents/*.md~/.codex/skills/*~/.cursor/skills/*~/.trae/skills/*~/.qoder/skills/*~/.tongyi-lingma/skills/*~/.peaks/config.json.peaks/config.json

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

package.json defines postinstall: node ./scripts/install-skills.mjs.
scripts/install-skills.mjs postinstall symlinks bundled skills into ~/.claude, ~/.codex, ~/.cursor, ~/.trae, ~/.qoder, ~/.tongyi-lingma and others.
scripts/install-skills.mjs copies bundled agent prompts into ~/.claude/agents and output styles into ~/.claude/output-styles by default.
scripts/install-skills.mjs creates/updates ~/.peaks/config.json during postinstall and may spawn `peaks upgrade --to 2.0 --auto` for detected 1.x projects.
Bundled SKILL.md files contain agent workflow instructions intended for AI IDE control surfaces.

Evidence against

No credential harvesting or external exfiltration endpoints found in inspected lifecycle code.
Network URLs observed are repository/homepage metadata; Playwright npx use is behind an explicit CLI command, not import-time.
Lifecycle installer has opt-out env vars and symlink/marker safety checks, but these do not make the default install user-consented.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 454 file(s), 2.94 MB of source, external domains: api.anthropic.com, api.example.com, api.openai.com, github.com, gitlab.com, reactbits.dev, www.google.com, www.pulsemcp.com

Source & flagged code

12 flagged

package.jsonView file

Lines 29-69json

29 "scripts/sync-version.mjs",

30 "scripts/install-skills.mjs",

31 "scripts/watch.mjs",

32 "skills/**",

33 "!skills/**/test-prompts.json",

34 "!skills/**/.DS_Store",

35 "output-styles/**",

36 "agents/**",

37 "schemas/*.json",

38 ".claude-plugin/**",

39 "README.md",

40 "README-en.md",

41 "CHANGELOG.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.json",

46 "prepack": "npm run build",

47 "prepublishOnly": "node scripts/prepublish-build.mjs",

48 "prepublish": "node ./scripts/sync-version.mjs",

49 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "predev": "node ./scripts/sync-version.mjs",

51 "dev": "tsx src/cli/index.ts",

52 "dev:watch": "node ./scripts/watch.mjs",

53 "pretest": "node ./scripts/sync-version.mjs",

54 "test": "node ./scripts/lint/silent-warning-detector.mjs && vitest run",

55 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

56 "test:race": "vitest run --no-file-parallelism tests/unit/g8-shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",

57 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

58 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

59 "test:coverage": "vitest run --coverage",

60 "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

61 "pretest:coverage": "node ./scripts/pretest-coverage.mjs",

62 "schema:generate": "node scripts/generate-context-schema.mjs",

63 "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

64 "mut:run": "peaks mut run --project . --out mut-report.json",

65 "mut:scan": "peaks mut asserts --in mut-report.json",

66 "audit:prose-ratio": "peaks audit prose-ratio --project ."

67 },

68 "engines": {

69 "node": ">=20.0.0"

dist/src/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

3 return new Promise((resolve, reject) => {

4 execFile(command, args, { cwd: options?.cwd, env: options?.env }, (error, stdout) => {

5 if (error) {

6 reject(error);

7 return;

8 }

9 resolve(stdout.trim());

10 });

11 });

12}

dist/src/services/upgrade/upgrade-service.jsView file

Lines 131-171javascript

131function read1xVersion(cwd) {

132 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

133 if (home.length === 0)

134 return null;

135 const global = join(home, '.peaks', 'config.json');

136 if (!existsSync(global))

137 return null;

138 try {

139 const raw = JSON.parse(readFileSync(global, 'utf8'));

140 if (typeof raw.version === 'string')

141 return raw.version;

142 }

143 catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)

144 // ignore

145 }

146 return null;

147}

148function runStep(peaksBin, name, args, timeoutMs = 60_000) {

149 const start = Date.now();

150 // The global `peaks` shim is a `/bin/sh` symlink script (the

151 // npm install postinstall creates `peaks` → `peaks.sh` on

152 // Windows). cmd.exe (the default Windows shell) cannot run

153 // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L151

154 // command 'migrate'" etc. The fix: prefer the local node

155 // binary + the peaks.js script path. The umbrella resolves

156 // the script path at startup; only falls back to `peaks` if

157 // no script path is available (Unix-only).

158 let command;

159 let spawnArgs;

160 if (peaksBin.includes('\\') || peaksBin.includes('/')) {

161 // peaksBin is a real path (e.g. /c/.../bin/peaks.js);

162 // invoke directly via node.

163 command = process.execPath;

164 spawnArgs = [peaksBin, ...args];

165 }

166 else {

167 // peaksBin is just "peaks" — best-effort shell exec.

168 command = peaksBin;

169 spawnArgs = args;

170 }

171 try {

dist/src/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

466 printResult(io, fail('loop.run', 'RUN_FAILED', getErrorMessage(error), { rid }, ['Verify the rid and session binding.']), options.json);

467 process.exitCode = 1;

468 }

469 });

470}

471/** Test seam: pick the next cycle-N.json number for capture-score

472 * writes. The run-driver also writes to the same dir; the next

473 * index = max(prior)+1, or 1. */

474function nextEvalCaptureIndex(projectRoot, sid, rid) {

475 const dir = join(projectRoot, '.peaks', '_runtime', sid, 'loop', rid, 'cycles');

476 if (!existsSync(dir))

477 return 1;

478 // eslint-disable-next-line @typescript-eslint/no-var-requires

479 const fs = require('node:fs');

480 let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

481 try {

482 entries = fs.readdirSync(dir);

483 }

484 catch {

485 return 1;

486 }

487 let best = null;

488 for (const entry of entries) {

489 const m = entry.match(/^cycle-(\d+)\.json$/);

490 if (m === null)

491 continue;

492 const n = parseInt(m[1] ?? '0', 10);

493 if (best === null || n > best)

494 best = n;

495 }

496 return (best ?? 0) + 1;

497}

498/** Map a run-driver code to a process exit code. */

dist/src/services/solo/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code: JOB_SHAPE_NOT_DECIDED,

76 message: `No Job-shape decision recorded for session ${sessionId}. Run \`peaks solo detect-job\` to record a decision.`,

77 details: { path }

78 });

79 }

80 let raw;

81 try {

82 raw = readFileSync(path, 'utf8');

83 }

84 catch (err) {

85 throw new JobShapeDecisionError({

86 code: JOB_SHAPE_NOT_DECIDED,

87 message: `Job-shape decision file is unreadable for session ${sessionId}. Run \`peaks solo detect-job\` to re-record.`,

88 details: { path, cause: err instanceof Error ? err.message : String(err) }

89 });

90 }

91 let parsed;

92 try {

93 parsed = JSON.parse(raw);

94 }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/services/solo/job-shape-decision.jsView on unpkg · L92

95 catch (err) {

96 throw new JobShapeDecisionError({

97 code: JOB_SHAPE_NOT_DECIDED,

98 message: `Job-shape decision file is malformed JSON for session ${sessionId}. Run \`peaks solo detect-job --force\` to overwrite.`,

99 details: { path, cause: err instanceof Error ? err.message : String(err) }

100 });

101 }

102 try {

103 return validateRecord(parsed);

104 }

105 catch (err) {

106 throw new JobShapeDecisionError({

107 code: JOB_SHAPE_NOT_DECIDED,

108 message: `Job-shape decision file is schema-invalid for session ${sessionId}. Run \`peaks solo detect-job --force\` to overwrite.`,

109 details: { path, cause: err instanceof Error ? err.message : String(err) }

110 });

111 }

112}

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

5import { homedir } from 'node:os';

6import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';

7import { fileURLToPath, pathToFileURL } from 'node:url';

9function getPathStats(path) {

10 try {

11 return lstatSync(path);

12 } catch {

13 return null;

14 }

15}

17function isBrokenSymlink(stats, targetPath) {

18 return stats.isSymbolicLink() && !existsSync(targetPath);

19}

21function validateManagedMarkerPath(markerPath) {

dist/src/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with the chosen port, and

12 * writes a session file at

13 * `<projectRoot>/.peaks/_runtime/playwright-sessions/<terminal-id>.json`

14 * with `{ port, userDataDir, startedAt, pid }`.

15 *

16 * 2. `peaks playwright ls` — lists all running sessions (reads

17 * `.peaks/_runtime/playwright-sessions/*.json`).

18 *

19 * 3. `peaks playwright stop [--terminal <id>]` — best-effort kills

20 * the server process and removes the session file.

21 *

22 * Terminal ID derivation (R4):

23 * 1. process.env.TERM_SESSION_ID (macOS Terminal / iTerm2)

24 * 2. process.env.WT_SESSION (Windows Terminal)

25 * 3. hash(process.ppid + process.env.SSH_TTY || 'no-tty')

26 *

27 * The CLI does NOT bundle `playwright-mcp`; it shells out to

28 * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle

29 * orchestrator, not the install medium.

30 */

31import { createHash } from 'node:crypto';

32import { spawn } from 'node:child_process';

33import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

34import { join, dirname, resolve } from 'node:path';

35import { resolveCanonicalProjectRoot } from '../../services/config/config-service.js';

36import { getErrorMessage } from '../cli-helpers.js';

37import { runBrowserAction } from '../../services/qa/browser-wrapper-service.js';

38export const DEFAULT_PORT = 8931;

39export const MAX_PORT = 8949;

40const BROWSERS = ['chromium', 'firefox', 'webkit'];

41export const PLAYWRIGHT_SESSIONS_DIR = 'playwright-sessions';

42export function playwrightSessionsDir(projectRoot) {

43 return join(projectRoot, '.peaks', '_runtime', PLAYWRIGHT_SESSIONS_DIR);

44}

45export function sessionFilePath(projectRoot, terminalId) {

46 return join(playwrightSessionsDir(projectRoot), `${terminalId}.json`);

47}

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.0 matchedPath = [redacted]-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/playwright-commands.jsView on unpkg

dist/src/services/code-review/ocr-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.0 matchedPath = dist/src/services/code-review/ocr-service.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/code-review/ocr-service.jsView on unpkg

dist/src/services/artifacts/artifact-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.0 matchedPath = [redacted]-service.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/artifacts/artifact-service.jsView on unpkg

dist/src/services/workspace/migrate-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/workspace/migrate-service.jsView on unpkg

dist/src/cli/commands/session-auto-compact-hook-command.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.0 matchedPath = dist/src/cli/commands/session-auto-compact-hook-command.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/session-auto-compact-hook-command.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

dist/src/services/upgrade/upgrade-service.jsView file

151// npm install postinstall creates `peaks` → `peaks.sh` on L152: // Windows). cmd.exe (the default Windows shell) cannot run L153: // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L151

dist/src/cli/commands/loop-eval-commands.jsView file

478// eslint-disable-next-line @typescript-eslint/no-var-requires L479: const fs = require('node:fs'); L480: let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

dist/src/services/solo/job-shape-decision.jsView file

92try { L93: parsed = JSON.parse(raw); L94: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/services/solo/job-shape-decision.jsView on unpkg · L92

scripts/install-skills.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L291: fchmodSync(fd, 0o600); L292: writeFileSync(fd, content, 'utf8'); L293: const writeFd = fd; ... L320: fchmodSync(fd, 0o600); L321: writeFileSync(fd, content, 'utf8'); L322: const writeFd = fd; ... L372: * cannot import the TS service at runtime. The dispatch: L373: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L374: * `.tongyi-lingma` in the project root in that insertion order Payload evidence from schemas/mcp-install-spec.schema.json: L1: { L2: "$schema": "https://json-schema.org/draft/2020-12/schema", L3: "title": "Peaks MCP Install Spec", ... L25: "items": { "type": "string" }, L26: "description": "Required env var names. Values are sourced from process.env at runtime and written as ${VAR} placeholders into settings.json." L27: }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

dist/src/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/playwright-commands.jsView on unpkg

dist/src/services/code-review/ocr-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/code-review/ocr-service.jsView on unpkg

dist/src/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/artifacts/artifact-service.jsView on unpkg

dist/src/services/workspace/migrate-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/workspace/migrate-service.jsView on unpkg

dist/src/cli/commands/session-auto-compact-hook-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/session-auto-compact-hook-command.jsView on unpkg

Findings

1 Critical9 High3 Medium6 Low

CriticalAi Agent Control Hijackscripts/install-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/shared/process.js

HighShelldist/src/services/upgrade/upgrade-service.js

HighRuntime Package Installdist/src/cli/commands/playwright-commands.js

HighKnown Malware Source Similaritydist/src/cli/commands/playwright-commands.js

HighKnown Malware Source Similaritydist/src/services/code-review/ocr-service.js

HighKnown Malware Source Similaritydist/src/services/artifacts/artifact-service.js

HighKnown Malware Source Similaritydist/src/services/workspace/migrate-service.js

HighKnown Malware Source Similaritydist/src/cli/commands/session-auto-compact-hook-command.js

MediumDynamic Requiredist/src/cli/commands/loop-eval-commands.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/src/services/solo/job-shape-decision.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

package.jsonView file

Lines 29-69json

29 "scripts/sync-version.mjs",

30 "scripts/install-skills.mjs",

31 "scripts/watch.mjs",

32 "skills/**",

33 "!skills/**/test-prompts.json",

34 "!skills/**/.DS_Store",

35 "output-styles/**",

36 "agents/**",

37 "schemas/*.json",

38 ".claude-plugin/**",

39 "README.md",

40 "README-en.md",

41 "CHANGELOG.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.json",

46 "prepack": "npm run build",

47 "prepublishOnly": "node scripts/prepublish-build.mjs",

48 "prepublish": "node ./scripts/sync-version.mjs",

49 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "predev": "node ./scripts/sync-version.mjs",

51 "dev": "tsx src/cli/index.ts",

52 "dev:watch": "node ./scripts/watch.mjs",

53 "pretest": "node ./scripts/sync-version.mjs",

54 "test": "node ./scripts/lint/silent-warning-detector.mjs && vitest run",

55 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

57 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

58 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

59 "test:coverage": "vitest run --coverage",

60 "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

61 "pretest:coverage": "node ./scripts/pretest-coverage.mjs",

62 "schema:generate": "node scripts/generate-context-schema.mjs",

63 "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

64 "mut:run": "peaks mut run --project . --out mut-report.json",

65 "mut:scan": "peaks mut asserts --in mut-report.json",

66 "audit:prose-ratio": "peaks audit prose-ratio --project ."

67 },

68 "engines": {

69 "node": ">=20.0.0"

dist/src/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

3 return new Promise((resolve, reject) => {

4 execFile(command, args, { cwd: options?.cwd, env: options?.env }, (error, stdout) => {

5 if (error) {

6 reject(error);

7 return;

8 }

9 resolve(stdout.trim());

10 });

11 });

12}

dist/src/services/upgrade/upgrade-service.jsView file

Lines 131-171javascript

131function read1xVersion(cwd) {

132 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

133 if (home.length === 0)

134 return null;

135 const global = join(home, '.peaks', 'config.json');

136 if (!existsSync(global))

137 return null;

138 try {

139 const raw = JSON.parse(readFileSync(global, 'utf8'));

140 if (typeof raw.version === 'string')

141 return raw.version;

142 }

143 catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)

144 // ignore

145 }

146 return null;

147}

148function runStep(peaksBin, name, args, timeoutMs = 60_000) {

149 const start = Date.now();

150 // The global `peaks` shim is a `/bin/sh` symlink script (the

151 // npm install postinstall creates `peaks` → `peaks.sh` on

152 // Windows). cmd.exe (the default Windows shell) cannot run

153 // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L151

154 // command 'migrate'" etc. The fix: prefer the local node

155 // binary + the peaks.js script path. The umbrella resolves

156 // the script path at startup; only falls back to `peaks` if

157 // no script path is available (Unix-only).

158 let command;

159 let spawnArgs;

160 if (peaksBin.includes('\\') || peaksBin.includes('/')) {

161 // peaksBin is a real path (e.g. /c/.../bin/peaks.js);

162 // invoke directly via node.

163 command = process.execPath;

164 spawnArgs = [peaksBin, ...args];

165 }

166 else {

167 // peaksBin is just "peaks" — best-effort shell exec.

168 command = peaksBin;

169 spawnArgs = args;

170 }

171 try {

dist/src/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

466 printResult(io, fail('loop.run', 'RUN_FAILED', getErrorMessage(error), { rid }, ['Verify the rid and session binding.']), options.json);

467 process.exitCode = 1;

468 }

469 });

470}

471/** Test seam: pick the next cycle-N.json number for capture-score

472 * writes. The run-driver also writes to the same dir; the next

473 * index = max(prior)+1, or 1. */

474function nextEvalCaptureIndex(projectRoot, sid, rid) {

475 const dir = join(projectRoot, '.peaks', '_runtime', sid, 'loop', rid, 'cycles');

476 if (!existsSync(dir))

477 return 1;

478 // eslint-disable-next-line @typescript-eslint/no-var-requires

479 const fs = require('node:fs');

480 let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

481 try {

482 entries = fs.readdirSync(dir);

483 }

484 catch {

485 return 1;

486 }

487 let best = null;

488 for (const entry of entries) {

489 const m = entry.match(/^cycle-(\d+)\.json$/);

490 if (m === null)

491 continue;

492 const n = parseInt(m[1] ?? '0', 10);

493 if (best === null || n > best)

494 best = n;

495 }

496 return (best ?? 0) + 1;

497}

498/** Map a run-driver code to a process exit code. */

dist/src/services/solo/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code: JOB_SHAPE_NOT_DECIDED,

76 message: `No Job-shape decision recorded for session ${sessionId}. Run \`peaks solo detect-job\` to record a decision.`,

77 details: { path }

78 });

79 }

80 let raw;

81 try {

82 raw = readFileSync(path, 'utf8');

83 }

84 catch (err) {

85 throw new JobShapeDecisionError({

86 code: JOB_SHAPE_NOT_DECIDED,

87 message: `Job-shape decision file is unreadable for session ${sessionId}. Run \`peaks solo detect-job\` to re-record.`,

88 details: { path, cause: err instanceof Error ? err.message : String(err) }

89 });

90 }

91 let parsed;

92 try {

93 parsed = JSON.parse(raw);

94 }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/services/solo/job-shape-decision.jsView on unpkg · L92

95 catch (err) {

96 throw new JobShapeDecisionError({

97 code: JOB_SHAPE_NOT_DECIDED,

98 message: `Job-shape decision file is malformed JSON for session ${sessionId}. Run \`peaks solo detect-job --force\` to overwrite.`,

99 details: { path, cause: err instanceof Error ? err.message : String(err) }

100 });

101 }

102 try {

103 return validateRecord(parsed);

104 }

105 catch (err) {

106 throw new JobShapeDecisionError({

107 code: JOB_SHAPE_NOT_DECIDED,

108 message: `Job-shape decision file is schema-invalid for session ${sessionId}. Run \`peaks solo detect-job --force\` to overwrite.`,

109 details: { path, cause: err instanceof Error ? err.message : String(err) }

110 });

111 }

112}

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

5import { homedir } from 'node:os';

6import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';

7import { fileURLToPath, pathToFileURL } from 'node:url';

9function getPathStats(path) {

10 try {

11 return lstatSync(path);

12 } catch {

13 return null;

14 }

15}

17function isBrokenSymlink(stats, targetPath) {

18 return stats.isSymbolicLink() && !existsSync(targetPath);

19}

21function validateManagedMarkerPath(markerPath) {

dist/src/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with the chosen port, and

12 * writes a session file at

13 * `<projectRoot>/.peaks/_runtime/playwright-sessions/<terminal-id>.json`

14 * with `{ port, userDataDir, startedAt, pid }`.

15 *

16 * 2. `peaks playwright ls` — lists all running sessions (reads

17 * `.peaks/_runtime/playwright-sessions/*.json`).

18 *

19 * 3. `peaks playwright stop [--terminal <id>]` — best-effort kills

20 * the server process and removes the session file.

21 *

22 * Terminal ID derivation (R4):

23 * 1. process.env.TERM_SESSION_ID (macOS Terminal / iTerm2)

24 * 2. process.env.WT_SESSION (Windows Terminal)

25 * 3. hash(process.ppid + process.env.SSH_TTY || 'no-tty')

26 *

27 * The CLI does NOT bundle `playwright-mcp`; it shells out to

28 * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle

29 * orchestrator, not the install medium.

30 */

31import { createHash } from 'node:crypto';

32import { spawn } from 'node:child_process';

33import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

34import { join, dirname, resolve } from 'node:path';

35import { resolveCanonicalProjectRoot } from '../../services/config/config-service.js';

36import { getErrorMessage } from '../cli-helpers.js';

37import { runBrowserAction } from '../../services/qa/browser-wrapper-service.js';

38export const DEFAULT_PORT = 8931;

39export const MAX_PORT = 8949;

40const BROWSERS = ['chromium', 'firefox', 'webkit'];

41export const PLAYWRIGHT_SESSIONS_DIR = 'playwright-sessions';

42export function playwrightSessionsDir(projectRoot) {

43 return join(projectRoot, '.peaks', '_runtime', PLAYWRIGHT_SESSIONS_DIR);

44}

45export function sessionFilePath(projectRoot, terminalId) {

46 return join(playwrightSessionsDir(projectRoot), `${terminalId}.json`);

47}

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/playwright-commands.jsView on unpkg

dist/src/services/code-review/ocr-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/code-review/ocr-service.jsView on unpkg

dist/src/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/artifacts/artifact-service.jsView on unpkg

dist/src/services/workspace/migrate-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/workspace/migrate-service.jsView on unpkg

dist/src/cli/commands/session-auto-compact-hook-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/session-auto-compact-hook-command.jsView on unpkg