registry / peaks-loop / 4.0.0-beta.2

peaks-loop@4.0.0-beta.2

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Confirmed unconsented npm postinstall mutation of broad AI-agent control surfaces. The package installs bundled skills, output styles, and agent prompts into multiple home-directory AI IDE locations and writes Peaks config during install.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install lifecycle postinstall

Impact

Installer can alter how multiple local AI agents load skills/agents without a separate user command or consent step.

Mechanism

postinstall AI-agent extension/control-surface fan-out

Policy narrative

On npm install, package.json runs scripts/install-skills.mjs. That script creates AI-agent skill/output-style/agent directories under multiple user home IDE profiles and links or copies package-supplied prompts there, plus writes managed marker files and user config. It can also auto-dispatch a peaks upgrade command for detected legacy projects. No remote exfiltration was found, but the install-time broad agent-control mutation is concrete.

Rationale

Source inspection confirms the scanner’s core concern: postinstall mutates broad AI-agent control surfaces across several IDEs without requiring an explicit user command. Under the install control-surface policy this is blockable even though the payloads are package-bundled and no network exfiltration was seen. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/install-skills.mjsagents/karpathy-reviewer.md.claude-plugin/marketplace.json~/.claude/skills/*~/.claude/output-styles/*~/.claude/agents/*~/.trae/skills/*~/.trae/output-styles/*~/.trae/agents/*~/.trae-cn/skills/*~/.codex/skills/*~/.codex/output-styles/*~/.codex/agents/*~/.cursor/skills/*~/.cursor/output-styles/*~/.cursor/agents/*~/.peaks/config.json

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for policy block

package.json defines postinstall: node ./scripts/install-skills.mjs.
scripts/install-skills.mjs postinstall fan-outs bundled skills to ~/.claude, ~/.trae, ~/.trae-cn, ~/.codex, ~/.cursor, ~/.qoder, ~/.tongyi-lingma, ~/.hermes, ~/.openclaw.
scripts/install-skills.mjs copies bundled agents to AI-agent agent dirs and writes .peaks-managed marker files.
scripts/install-skills.mjs creates/updates ~/.peaks/config.json during postinstall.
scripts/install-skills.mjs may spawnSync('peaks', ['upgrade', ...]) from postinstall when 1.x project state is detected.

Evidence against

No HTTP/fetch exfiltration endpoints found in inspected install path.
Install script uses package-bundled skills/output-styles/agents, not downloaded remote payloads.
Existing non-managed files are skipped rather than overwritten in several install paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 486 file(s), 3.05 MB of source, external domains: api.anthropic.com, api.example.com, api.openai.com, github.com, gitlab.com, reactbits.dev, www.google.com, www.pulsemcp.com

Source & flagged code

12 flagged

package.jsonView file

Lines 29-69json

29 "scripts/sync-version.mjs",

30 "scripts/install-skills.mjs",

31 "scripts/watch.mjs",

32 "skills/**",

33 "!skills/**/test-prompts.json",

34 "!skills/**/.DS_Store",

35 "output-styles/**",

36 "agents/**",

37 "schemas/*.json",

38 ".claude-plugin/**",

39 "README.md",

40 "README-en.md",

41 "CHANGELOG.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.json",

46 "prepack": "npm run build",

47 "prepublishOnly": "node scripts/prepublish-build.mjs",

48 "prepublish": "node ./scripts/sync-version.mjs",

49 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "predev": "node ./scripts/sync-version.mjs",

51 "dev": "tsx src/cli/index.ts",

52 "dev:watch": "node ./scripts/watch.mjs",

53 "pretest": "node ./scripts/sync-version.mjs",

54 "test": "node ./scripts/lint/silent-warning-detector.mjs && vitest run",

55 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

56 "test:race": "vitest run --no-file-parallelism tests/unit/g8-shared-channel.test.ts tests/unit/dispatch-record-writer.test.ts tests/unit/services/retrospective/heartbeat.test.ts tests/unit/cli/commands/share-commands.test.ts",

57 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

58 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

59 "test:coverage": "vitest run --coverage",

60 "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

61 "pretest:coverage": "node ./scripts/pretest-coverage.mjs",

62 "schema:generate": "node scripts/generate-context-schema.mjs",

63 "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

64 "mut:run": "peaks mut run --project . --out mut-report.json",

65 "mut:scan": "peaks mut asserts --in mut-report.json",

66 "audit:prose-ratio": "peaks audit prose-ratio --project .",

67 "dogfood:sediment": "bash scripts/dogfood-sediment-cycle.sh"

68 },

69 "engines": {

dist/src/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

3 return new Promise((resolve, reject) => {

4 execFile(command, args, { cwd: options?.cwd, env: options?.env }, (error, stdout) => {

5 if (error) {

6 reject(error);

7 return;

8 }

9 resolve(stdout.trim());

10 });

11 });

12}

dist/src/services/upgrade/upgrade-service.jsView file

Lines 162-202javascript

162}

163function read1xVersion(cwd) {

164 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

165 if (home.length === 0)

166 return null;

167 const global = join(home, '.peaks', 'config.json');

168 if (!existsSync(global))

169 return null;

170 try {

171 const raw = JSON.parse(readFileSync(global, 'utf8'));

172 if (typeof raw.version === 'string')

173 return raw.version;

174 }

175 catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)

176 // ignore

177 }

178 return null;

179}

180function runStep(peaksBin, name, args, timeoutMs = 60_000, executor = defaultSubstepExecutor) {

181 // The global `peaks` shim is a `/bin/sh` symlink script (the

182 // npm install postinstall creates `peaks` → `peaks.sh` on

183 // Windows). cmd.exe (the default Windows shell) cannot run

184 // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L182

185 // command 'migrate'" etc. The fix: prefer the local node

186 // binary + the peaks.js script path. The umbrella resolves

187 // the script path at startup; only falls back to `peaks` if

188 // no script path is available (Unix-only).

189 let command;

190 let spawnArgs;

191 if (peaksBin.includes('\\') || peaksBin.includes('/')) {

192 // peaksBin is a real path (e.g. /c/.../bin/peaks.js);

193 // invoke directly via node.

194 command = process.execPath;

195 spawnArgs = [peaksBin, ...args];

196 }

197 else {

198 // peaksBin is just "peaks" — best-effort shell exec.

199 command = peaksBin;

200 spawnArgs = args;

201 }

202 // The executor normalizes spawn errors to { status: null, stderr: ... }

dist/src/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

466 printResult(io, fail('loop.run', 'RUN_FAILED', getErrorMessage(error), { rid }, ['Verify the rid and session binding.']), options.json);

467 process.exitCode = 1;

468 }

469 });

470}

471/** Test seam: pick the next cycle-N.json number for capture-score

472 * writes. The run-driver also writes to the same dir; the next

473 * index = max(prior)+1, or 1. */

474function nextEvalCaptureIndex(projectRoot, sid, rid) {

475 const dir = join(projectRoot, '.peaks', '_runtime', sid, 'loop', rid, 'cycles');

476 if (!existsSync(dir))

477 return 1;

478 // eslint-disable-next-line @typescript-eslint/no-var-requires

479 const fs = require('node:fs');

480 let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

481 try {

482 entries = fs.readdirSync(dir);

483 }

484 catch {

485 return 1;

486 }

487 let best = null;

488 for (const entry of entries) {

489 const m = entry.match(/^cycle-(\d+)\.json$/);

490 if (m === null)

491 continue;

492 const n = parseInt(m[1] ?? '0', 10);

493 if (best === null || n > best)

494 best = n;

495 }

496 return (best ?? 0) + 1;

497}

498/** Map a run-driver code to a process exit code. */

dist/src/services/code/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code: JOB_SHAPE_NOT_DECIDED,

76 message: `No Job-shape decision recorded for session ${sessionId}. Run \`peaks code detect-job\` to record a decision.`,

77 details: { path }

78 });

79 }

80 let raw;

81 try {

82 raw = readFileSync(path, 'utf8');

83 }

84 catch (err) {

85 throw new JobShapeDecisionError({

86 code: JOB_SHAPE_NOT_DECIDED,

87 message: `Job-shape decision file is unreadable for session ${sessionId}. Run \`peaks code detect-job\` to re-record.`,

88 details: { path, cause: err instanceof Error ? err.message : String(err) }

89 });

90 }

91 let parsed;

92 try {

93 parsed = JSON.parse(raw);

94 }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/services/code/job-shape-decision.jsView on unpkg · L92

95 catch (err) {

96 throw new JobShapeDecisionError({

97 code: JOB_SHAPE_NOT_DECIDED,

98 message: `Job-shape decision file is malformed JSON for session ${sessionId}. Run \`peaks code detect-job --force\` to overwrite.`,

99 details: { path, cause: err instanceof Error ? err.message : String(err) }

100 });

101 }

102 try {

103 return validateRecord(parsed);

104 }

105 catch (err) {

106 throw new JobShapeDecisionError({

107 code: JOB_SHAPE_NOT_DECIDED,

108 message: `Job-shape decision file is schema-invalid for session ${sessionId}. Run \`peaks code detect-job --force\` to overwrite.`,

109 details: { path, cause: err instanceof Error ? err.message : String(err) }

110 });

111 }

112}

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

5import { homedir } from 'node:os';

6import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';

7import { fileURLToPath, pathToFileURL } from 'node:url';

9function getPathStats(path) {

10 try {

11 return lstatSync(path);

12 } catch {

13 return null;

14 }

15}

17function isBrokenSymlink(stats, targetPath) {

18 return stats.isSymbolicLink() && !existsSync(targetPath);

19}

21function validateManagedMarkerPath(markerPath) {

dist/src/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with the chosen port, and

12 * writes a session file at

13 * `<projectRoot>/.peaks/_runtime/playwright-sessions/<terminal-id>.json`

14 * with `{ port, userDataDir, startedAt, pid }`.

15 *

16 * 2. `peaks playwright ls` — lists all running sessions (reads

17 * `.peaks/_runtime/playwright-sessions/*.json`).

18 *

19 * 3. `peaks playwright stop [--terminal <id>]` — best-effort kills

20 * the server process and removes the session file.

21 *

22 * Terminal ID derivation (R4):

23 * 1. process.env.TERM_SESSION_ID (macOS Terminal / iTerm2)

24 * 2. process.env.WT_SESSION (Windows Terminal)

25 * 3. hash(process.ppid + process.env.SSH_TTY || 'no-tty')

26 *

27 * The CLI does NOT bundle `playwright-mcp`; it shells out to

28 * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle

29 * orchestrator, not the install medium.

30 */

31import { createHash } from 'node:crypto';

32import { spawn } from 'node:child_process';

33import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

34import { join, dirname, resolve } from 'node:path';

35import { resolveCanonicalProjectRoot } from '../../services/config/config-service.js';

36import { getErrorMessage } from '../cli-helpers.js';

37import { runBrowserAction } from '../../services/qa/browser-wrapper-service.js';

38export const DEFAULT_PORT = 8931;

39export const MAX_PORT = 8949;

40const BROWSERS = ['chromium', 'firefox', 'webkit'];

41export const PLAYWRIGHT_SESSIONS_DIR = 'playwright-sessions';

42export function playwrightSessionsDir(projectRoot) {

43 return join(projectRoot, '.peaks', '_runtime', PLAYWRIGHT_SESSIONS_DIR);

44}

45export function sessionFilePath(projectRoot, terminalId) {

46 return join(playwrightSessionsDir(projectRoot), `${terminalId}.json`);

47}

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.2 matchedPath = [redacted]-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/playwright-commands.jsView on unpkg

dist/src/services/code-review/ocr-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.2 matchedPath = dist/src/services/code-review/ocr-service.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/code-review/ocr-service.jsView on unpkg

dist/src/services/artifacts/artifact-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.2 matchedPath = [redacted]-service.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/artifacts/artifact-service.jsView on unpkg

dist/src/services/workspace/migrate-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/workspace/migrate-service.jsView on unpkg

dist/src/cli/commands/session-auto-compact-hook-command.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@3.1.2 matchedPath = dist/src/cli/commands/session-auto-compact-hook-command.js matchedIdentity = npm:cGVha3MtbG9vcA:3.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/session-auto-compact-hook-command.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/src/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

dist/src/services/upgrade/upgrade-service.jsView file

182// npm install postinstall creates `peaks` → `peaks.sh` on L183: // Windows). cmd.exe (the default Windows shell) cannot run L184: // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L182

dist/src/cli/commands/loop-eval-commands.jsView file

478// eslint-disable-next-line @typescript-eslint/no-var-requires L479: const fs = require('node:fs'); L480: let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

dist/src/services/code/job-shape-decision.jsView file

92try { L93: parsed = JSON.parse(raw); L94: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/services/code/job-shape-decision.jsView on unpkg · L92

scripts/install-skills.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L291: fchmodSync(fd, 0o600); L292: writeFileSync(fd, content, 'utf8'); L293: const writeFd = fd; ... L320: fchmodSync(fd, 0o600); L321: writeFileSync(fd, content, 'utf8'); L322: const writeFd = fd; ... L372: * cannot import the TS service at runtime. The dispatch: L373: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L374: * `.tongyi-lingma` in the project root in that insertion order Payload evidence from schemas/mcp-install-spec.schema.json: L1: { L2: "$schema": "https://json-schema.org/draft/2020-12/schema", L3: "title": "Peaks MCP Install Spec", ... L25: "items": { "type": "string" }, L26: "description": "Required env var names. Values are sourced from process.env at runtime and written as ${VAR} placeholders into settings.json." L27: }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

dist/src/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/playwright-commands.jsView on unpkg

dist/src/services/code-review/ocr-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/code-review/ocr-service.jsView on unpkg

dist/src/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/artifacts/artifact-service.jsView on unpkg

dist/src/services/workspace/migrate-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/workspace/migrate-service.jsView on unpkg

dist/src/cli/commands/session-auto-compact-hook-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/session-auto-compact-hook-command.jsView on unpkg

Findings

1 Critical9 High3 Medium7 Low

CriticalAi Agent Control Hijackscripts/install-skills.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/shared/process.js

HighShelldist/src/services/upgrade/upgrade-service.js

HighRuntime Package Installdist/src/cli/commands/playwright-commands.js

HighKnown Malware Source Similaritydist/src/cli/commands/playwright-commands.js

HighKnown Malware Source Similaritydist/src/services/code-review/ocr-service.js

HighKnown Malware Source Similaritydist/src/services/artifacts/artifact-service.js

HighKnown Malware Source Similaritydist/src/services/workspace/migrate-service.js

HighKnown Malware Source Similaritydist/src/cli/commands/session-auto-compact-hook-command.js

MediumDynamic Requiredist/src/cli/commands/loop-eval-commands.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/src/services/code/job-shape-decision.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

12 flagged

package.jsonView file

Lines 29-69json

29 "scripts/sync-version.mjs",

30 "scripts/install-skills.mjs",

31 "scripts/watch.mjs",

32 "skills/**",

33 "!skills/**/test-prompts.json",

34 "!skills/**/.DS_Store",

35 "output-styles/**",

36 "agents/**",

37 "schemas/*.json",

38 ".claude-plugin/**",

39 "README.md",

40 "README-en.md",

41 "CHANGELOG.md",

42 "LICENSE"

43 ],

44 "scripts": {

45 "build": "node ./scripts/sync-version.mjs && node ./scripts/clean-dist.mjs && tsc -p tsconfig.json",

46 "prepack": "npm run build",

47 "prepublishOnly": "node scripts/prepublish-build.mjs",

48 "prepublish": "node ./scripts/sync-version.mjs",

49 "postinstall": "node ./scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

50 "predev": "node ./scripts/sync-version.mjs",

51 "dev": "tsx src/cli/index.ts",

52 "dev:watch": "node ./scripts/watch.mjs",

53 "pretest": "node ./scripts/sync-version.mjs",

54 "test": "node ./scripts/lint/silent-warning-detector.mjs && vitest run",

55 "lint:silent-warning": "node ./scripts/lint/silent-warning-detector.mjs",

57 "test:replay": "node scripts/fixture-capture-setup.mjs && vitest run tests/unit/replay tests/unit/fixture",

58 "fixture:capture-setup": "node scripts/fixture-capture-setup.mjs",

59 "test:coverage": "vitest run --coverage",

60 "test:coverage:workflow": "vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

61 "pretest:coverage": "node ./scripts/pretest-coverage.mjs",

62 "schema:generate": "node scripts/generate-context-schema.mjs",

63 "typecheck": "tsc -p tsconfig.json --noEmit && vitest run --coverage --coverage.include='src/services/workflow/plan-*.ts' tests/unit/services/workflow/",

64 "mut:run": "peaks mut run --project . --out mut-report.json",

65 "mut:scan": "peaks mut asserts --in mut-report.json",

66 "audit:prose-ratio": "peaks audit prose-ratio --project .",

67 "dogfood:sediment": "bash scripts/dogfood-sediment-cycle.sh"

68 },

69 "engines": {

dist/src/shared/process.jsView file

Lines 1-13javascript

1import { execFile } from 'node:child_process';

2export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/src/shared/process.jsView on unpkg · L1

3 return new Promise((resolve, reject) => {

4 execFile(command, args, { cwd: options?.cwd, env: options?.env }, (error, stdout) => {

5 if (error) {

6 reject(error);

7 return;

8 }

9 resolve(stdout.trim());

10 });

11 });

12}

dist/src/services/upgrade/upgrade-service.jsView file

Lines 162-202javascript

162}

163function read1xVersion(cwd) {

164 const home = process.env['HOME'] ?? process.env['USERPROFILE'] ?? '';

165 if (home.length === 0)

166 return null;

167 const global = join(home, '.peaks', 'config.json');

168 if (!existsSync(global))

169 return null;

170 try {

171 const raw = JSON.parse(readFileSync(global, 'utf8'));

172 if (typeof raw.version === 'string')

173 return raw.version;

174 }

175 catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)

176 // ignore

177 }

178 return null;

179}

180function runStep(peaksBin, name, args, timeoutMs = 60_000, executor = defaultSubstepExecutor) {

181 // The global `peaks` shim is a `/bin/sh` symlink script (the

182 // npm install postinstall creates `peaks` → `peaks.sh` on

183 // Windows). cmd.exe (the default Windows shell) cannot run

184 // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/src/services/upgrade/upgrade-service.jsView on unpkg · L182

185 // command 'migrate'" etc. The fix: prefer the local node

186 // binary + the peaks.js script path. The umbrella resolves

187 // the script path at startup; only falls back to `peaks` if

188 // no script path is available (Unix-only).

189 let command;

190 let spawnArgs;

191 if (peaksBin.includes('\\') || peaksBin.includes('/')) {

192 // peaksBin is a real path (e.g. /c/.../bin/peaks.js);

193 // invoke directly via node.

194 command = process.execPath;

195 spawnArgs = [peaksBin, ...args];

196 }

197 else {

198 // peaksBin is just "peaks" — best-effort shell exec.

199 command = peaksBin;

200 spawnArgs = args;

201 }

202 // The executor normalizes spawn errors to { status: null, stderr: ... }

dist/src/cli/commands/loop-eval-commands.jsView file

Lines 458-498javascript

458 cycles: result.cycles,

459 finalReport: result.finalReport,

460 finalReportCode,

461 summary: result.summary

462 }, nextActionsForCode(result.code, r2, sid, result.summary)), options.json);

463 process.exitCode = exitCode;

464 }

465 catch (error) {

466 printResult(io, fail('loop.run', 'RUN_FAILED', getErrorMessage(error), { rid }, ['Verify the rid and session binding.']), options.json);

467 process.exitCode = 1;

468 }

469 });

470}

471/** Test seam: pick the next cycle-N.json number for capture-score

472 * writes. The run-driver also writes to the same dir; the next

473 * index = max(prior)+1, or 1. */

474function nextEvalCaptureIndex(projectRoot, sid, rid) {

475 const dir = join(projectRoot, '.peaks', '_runtime', sid, 'loop', rid, 'cycles');

476 if (!existsSync(dir))

477 return 1;

478 // eslint-disable-next-line @typescript-eslint/no-var-requires

479 const fs = require('node:fs');

480 let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli/commands/loop-eval-commands.jsView on unpkg · L478

481 try {

482 entries = fs.readdirSync(dir);

483 }

484 catch {

485 return 1;

486 }

487 let best = null;

488 for (const entry of entries) {

489 const m = entry.match(/^cycle-(\d+)\.json$/);

490 if (m === null)

491 continue;

492 const n = parseInt(m[1] ?? '0', 10);

493 if (best === null || n > best)

494 best = n;

495 }

496 return (best ?? 0) + 1;

497}

498/** Map a run-driver code to a process exit code. */

dist/src/services/code/job-shape-decision.jsView file

Lines 72-112javascript

72 const path = decisionPath(projectRoot, sessionId);

73 if (!existsSync(path)) {

74 throw new JobShapeDecisionError({

75 code: JOB_SHAPE_NOT_DECIDED,

76 message: `No Job-shape decision recorded for session ${sessionId}. Run \`peaks code detect-job\` to record a decision.`,

77 details: { path }

78 });

79 }

80 let raw;

81 try {

82 raw = readFileSync(path, 'utf8');

83 }

84 catch (err) {

85 throw new JobShapeDecisionError({

86 code: JOB_SHAPE_NOT_DECIDED,

87 message: `Job-shape decision file is unreadable for session ${sessionId}. Run \`peaks code detect-job\` to re-record.`,

88 details: { path, cause: err instanceof Error ? err.message : String(err) }

89 });

90 }

91 let parsed;

92 try {

93 parsed = JSON.parse(raw);

94 }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/services/code/job-shape-decision.jsView on unpkg · L92

95 catch (err) {

96 throw new JobShapeDecisionError({

97 code: JOB_SHAPE_NOT_DECIDED,

98 message: `Job-shape decision file is malformed JSON for session ${sessionId}. Run \`peaks code detect-job --force\` to overwrite.`,

99 details: { path, cause: err instanceof Error ? err.message : String(err) }

100 });

101 }

102 try {

103 return validateRecord(parsed);

104 }

105 catch (err) {

106 throw new JobShapeDecisionError({

107 code: JOB_SHAPE_NOT_DECIDED,

108 message: `Job-shape decision file is schema-invalid for session ${sessionId}. Run \`peaks code detect-job --force\` to overwrite.`,

109 details: { path, cause: err instanceof Error ? err.message : String(err) }

110 });

111 }

112}

scripts/install-skills.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

3import { spawnSync } from 'node:child_process';

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/install-skills.mjsView on unpkg · L1

4import { createHash, randomUUID } from 'node:crypto';

5import { homedir } from 'node:os';

6import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';

7import { fileURLToPath, pathToFileURL } from 'node:url';

9function getPathStats(path) {

10 try {

11 return lstatSync(path);

12 } catch {

13 return null;

14 }

15}

17function isBrokenSymlink(stats, targetPath) {

18 return stats.isSymbolicLink() && !existsSync(targetPath);

19}

21function validateManagedMarkerPath(markerPath) {

dist/src/cli/commands/playwright-commands.jsView file

Lines 7-47javascript

7 * dir. This command:

8 *

9 * 1. `peaks playwright start [--port N] [--browser <chromium|firefox|webkit>]`

10 * Allocates a unique port (default 8931; walks 8931→8949 if busy),

11 * spawns `npx playwright-mcp@latest` with the chosen port, and

12 * writes a session file at

13 * `<projectRoot>/.peaks/_runtime/playwright-sessions/<terminal-id>.json`

14 * with `{ port, userDataDir, startedAt, pid }`.

15 *

16 * 2. `peaks playwright ls` — lists all running sessions (reads

17 * `.peaks/_runtime/playwright-sessions/*.json`).

18 *

19 * 3. `peaks playwright stop [--terminal <id>]` — best-effort kills

20 * the server process and removes the session file.

21 *

22 * Terminal ID derivation (R4):

23 * 1. process.env.TERM_SESSION_ID (macOS Terminal / iTerm2)

24 * 2. process.env.WT_SESSION (Windows Terminal)

25 * 3. hash(process.ppid + process.env.SSH_TTY || 'no-tty')

26 *

27 * The CLI does NOT bundle `playwright-mcp`; it shells out to

28 * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle

29 * orchestrator, not the install medium.

30 */

31import { createHash } from 'node:crypto';

32import { spawn } from 'node:child_process';

33import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/cli/commands/playwright-commands.jsView on unpkg · L27

34import { join, dirname, resolve } from 'node:path';

35import { resolveCanonicalProjectRoot } from '../../services/config/config-service.js';

36import { getErrorMessage } from '../cli-helpers.js';

37import { runBrowserAction } from '../../services/qa/browser-wrapper-service.js';

38export const DEFAULT_PORT = 8931;

39export const MAX_PORT = 8949;

40const BROWSERS = ['chromium', 'firefox', 'webkit'];

41export const PLAYWRIGHT_SESSIONS_DIR = 'playwright-sessions';

42export function playwrightSessionsDir(projectRoot) {

43 return join(projectRoot, '.peaks', '_runtime', PLAYWRIGHT_SESSIONS_DIR);

44}

45export function sessionFilePath(projectRoot, terminalId) {

46 return join(playwrightSessionsDir(projectRoot), `${terminalId}.json`);

47}

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/playwright-commands.jsView on unpkg

dist/src/services/code-review/ocr-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/code-review/ocr-service.jsView on unpkg

dist/src/services/artifacts/artifact-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/artifacts/artifact-service.jsView on unpkg

dist/src/services/workspace/migrate-service.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/services/workspace/migrate-service.jsView on unpkg

dist/src/cli/commands/session-auto-compact-hook-command.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/commands/session-auto-compact-hook-command.jsView on unpkg