registry / peaks-loop / 4.0.0-beta.14

peaks-loop@4.0.0-beta.14

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package triggers unconsented mutation of broad, foreign AI-agent control surfaces. It deploys package-controlled skills, prompts, and styles across multiple agent platforms and modifies user configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm lifecycle `postinstall` during package installation

Impact

Package-controlled instructions become discoverable by multiple local AI-agent runtimes without an explicit setup command.

Mechanism

cross-platform AI-agent skill and prompt deployment via symlinks and file writes

Policy narrative

On installation, `postinstall` runs `scripts/install-skills.mjs`. The script iterates its configured AI-agent profiles and installs package-owned skills into agent discovery directories, including Codex, Claude, Cursor, Trae, Qoder, and others; it also installs agent prompts and output styles, and creates user configuration. These are automatic writes to broad foreign agent control surfaces, not an explicit user-invoked setup flow.

Rationale

Source inspection confirms a concrete npm postinstall chain that deploys package-controlled AI-agent instructions across multiple unrelated agent homes. Under the firewall policy, this is an unconsented broad AI-agent control-surface mutation and requires blocking.

Evidence

package.jsonscripts/install-skills.mjsagents/karpathy-reviewer.mdskills/peaks-code/SKILL.md.claude-plugin/marketplace.jsonskills/agents/output-styles/~/.claude/skills~/.codex/skills~/.cursor/skills~/.claude/agents~/.peaks/config.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `scripts/install-skills.mjs` as `postinstall`.
`scripts/install-skills.mjs` fan-outs bundled skills to every configured AI-agent home directory, including `~/.codex/skills`, `~/.cursor/skills`, and `~/.claude/skills`.
The postinstall creates symlinks to package-supplied skill directories and writes `.peaks-managed` markers.
The postinstall copies package-supplied agent prompts into agent loader directories and writes output styles.
The postinstall creates/updates `~/.peaks/config.json` and can invoke `peaks upgrade --auto` against the install CWD.

Evidence against

Install script has opt-out environment variables and symlink/path-integrity checks.
No network request or credential-exfiltration behavior was found in the inspected postinstall path.
Bundled skill text includes directions not to persist sensitive browser/session data.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 530 file(s), 3.43 MB of source, external domains: api.anthropic.com, api.example.com, api.github.com, api.openai.com, github.com, gitlab.com, reactbits.dev, www.google.com, www.pulsemcp.com

Source & flagged code

12 flagged

package.jsonView file

Lines 36-76json

36 "!skills/**/test-prompts.json",

37 "!skills/**/.DS_Store",

38 "output-styles/**",

39 "agents/**",

40 "schemas/*.json",

41 ".claude-plugin/**",

42 "README.md",

43 "README-en.md",

44 "CHANGELOG.md",

45 "LICENSE",

46 "examples/video-demo/preview/peaks-loop-demo.mp4",

47 "examples/video-demo/preview/peaks-loop-demo-en.mp4",

48 "examples/video-demo/out/zh-closing-960.png",

49 "examples/video-demo/out/en-closing-960.png"

50 ],

51 "scripts": {

52 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node ./scripts/copy-templates.mjs",

53 "prepack": "npm run build",

54 "prepublishOnly": "node scripts/prepublish-build.mjs",

55 "prepublish": "node ./scripts/sync-version.mjs",

56 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

57 "predev": "node ./scripts/sync-version.mjs",

58 "dev": "tsx src/cli/index.ts",

59 "dev:watch": "node ./scripts/watch.mjs",

60 "pretest": "node ./scripts/sync-version.mjs",

61 "test": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",

62 "test:full": "vitest run",

63 "test:fast": "vitest run --maxWorkers=8 -t \"^((?!@slow|@integration|@replay).)*$\" tests/unit",

64 "test:dev": "vitest run tests/unit",

65 "test:dev:cli": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",

66 "test:unit": "vitest run tests/unit",

67 "test:integration": "vitest run tests/integration",

68 "test:cli": "vitest run tests/unit/cli-program.core.test.ts tests/unit/cli-program.stateful.test.ts tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/cli-program.workspace.test.ts tests/unit/cli",

69 "test:workflow": "vitest run tests/unit/cli-program.workflow.test.ts tests/unit/cli-program.workflow-cli.test.ts tests/unit/workflow-autonomous-resume-validation.test.ts tests/unit/workflow-autonomous-service.test.ts tests/unit/workflow-router-service.test.ts tests/unit/skill-browser-workflow.test.ts tests/unit/services/workflow",

70 "test:audit:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

71 "test:ci": "node ./scripts/sync-version.mjs && node ./scripts/lint/silent-warning-detector.mjs && vitest run --coverage",

72 "test:changed": "node scripts/test-changed.mjs",

73 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

74 "test:race": "vitest run --no-file-parallelism tests/unit/g8-shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",

75 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

76 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

dist/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

3 return new Promise((resolve,

dist/services/upgrade/upgrade-service.jsView file

Lines 162-202javascript

162}

163function read1xVersion(cwd) {

164 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

165 if (home.length === 0)

dist/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

dist/services/code/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code: JOB_SHAPE_NOT_DECIDED,

76 message: `No Job-shape decision recorded for session ${sessionId}. Run

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

dist/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with

dist/services/code-review/ocr-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.10 matchedPath = dist/services/code-review/ocr-service.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/code-review/ocr-service.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.10 matchedPath = [redacted]-service.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/runtime/vendors/codex.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.10 matchedPath = [redacted].js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/codex.jsView on unpkg

dist/services/runtime/vendors/copilot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/copilot.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

dist/services/upgrade/upgrade-service.jsView file

182// npm install postinstall creates `peaks` → `peaks.sh` on L183: // Windows). cmd.exe (the default Windows shell) cannot run L184: // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/services/upgrade/upgrade-service.jsView on unpkg · L182

dist/cli/commands/loop-eval-commands.jsView file

478// eslint-disable-next-line @typescript-eslint/no-var-requires L479: const fs = require('node:fs'); L480: let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/commands/loop-eval-commands.jsView on unpkg · L478

dist/services/code/job-shape-decision.jsView file

92try { L93: parsed = JSON.parse(raw); L94: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/services/code/job-shape-decision.jsView on unpkg · L92

scripts/install-skills.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L285: fchmodSync(fd, 0o600); L286: writeFileSync(fd, content, 'utf8'); L287: const writeFd = fd; ... L314: fchmodSync(fd, 0o600); L315: writeFileSync(fd, content, 'utf8'); L316: const writeFd = fd; ... L366: * cannot import the TS service at runtime. The dispatch: L367: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L368: * `.tongyi-lingma` in the project root in that insertion order Payload evidence from schemas/mcp-install-spec.schema.json: L1: { L2: "$schema": "https://json-schema.org/draft/2020-12/schema", L3: "title": "Peaks MCP Install Spec", ... L25: "items": { "type": "string" }, L26: "description": "Required env var names. Values are sourced from process.env at runtime and written as ${VAR} placeholders into settings.json." L27: }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

dist/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/playwright-commands.jsView on unpkg · L27

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.10 matchedPath = dist/cli/commands/playwright-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/playwright-commands.jsView on unpkg

dist/services/code-review/ocr-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/code-review/ocr-service.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/runtime/vendors/codex.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/codex.jsView on unpkg

dist/services/runtime/vendors/copilot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/copilot.jsView on unpkg

Findings

1 Critical9 High4 Medium7 Low

CriticalAi Agent Control Hijackscripts/install-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/shared/process.js

HighShelldist/services/upgrade/upgrade-service.js

HighRuntime Package Installdist/cli/commands/playwright-commands.js

HighKnown Malware Source Similaritydist/cli/commands/playwright-commands.js

HighKnown Malware Source Similaritydist/services/code-review/ocr-service.js

HighKnown Malware Source Similaritydist/services/artifacts/artifact-service.js

HighKnown Malware Source Similaritydist/services/runtime/vendors/codex.js

HighKnown Malware Source Similaritydist/services/runtime/vendors/copilot.js

MediumDynamic Requiredist/cli/commands/loop-eval-commands.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/services/code/job-shape-decision.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

12 flagged

package.jsonView file

Lines 36-76json

36 "!skills/**/test-prompts.json",

37 "!skills/**/.DS_Store",

38 "output-styles/**",

39 "agents/**",

40 "schemas/*.json",

41 ".claude-plugin/**",

42 "README.md",

43 "README-en.md",

44 "CHANGELOG.md",

45 "LICENSE",

46 "examples/video-demo/preview/peaks-loop-demo.mp4",

47 "examples/video-demo/preview/peaks-loop-demo-en.mp4",

48 "examples/video-demo/out/zh-closing-960.png",

49 "examples/video-demo/out/en-closing-960.png"

50 ],

51 "scripts": {

52 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.build.json && node ./scripts/copy-templates.mjs",

53 "prepack": "npm run build",

54 "prepublishOnly": "node scripts/prepublish-build.mjs",

55 "prepublish": "node ./scripts/sync-version.mjs",

56 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

57 "predev": "node ./scripts/sync-version.mjs",

58 "dev": "tsx src/cli/index.ts",

59 "dev:watch": "node ./scripts/watch.mjs",

60 "pretest": "node ./scripts/sync-version.mjs",

62 "test:full": "vitest run",

63 "test:fast": "vitest run --maxWorkers=8 -t \"^((?!@slow|@integration|@replay).)*$\" tests/unit",

64 "test:dev": "vitest run tests/unit",

66 "test:unit": "vitest run tests/unit",

67 "test:integration": "vitest run tests/integration",

70 "test:audit:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

71 "test:ci": "node ./scripts/sync-version.mjs && node ./scripts/lint/silent-warning-detector.mjs && vitest run --coverage",

72 "test:changed": "node scripts/test-changed.mjs",

73 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

75 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

76 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

dist/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

3 return new Promise((resolve,

dist/services/upgrade/upgrade-service.jsView file

Lines 162-202javascript

162}

163function read1xVersion(cwd) {

164 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

165 if (home.length === 0)

dist/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

dist/services/code/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code: JOB_SHAPE_NOT_DECIDED,

76 message: `No Job-shape decision recorded for session ${sessionId}. Run

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

dist/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with

dist/services/code-review/ocr-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/code-review/ocr-service.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/runtime/vendors/codex.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/codex.jsView on unpkg

dist/services/runtime/vendors/copilot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/copilot.jsView on unpkg