Loading npm security reports…

peaks-loop@4.0.2: AI-agent policy block | LPM Firewall

registry / peaks-loop / 4.0.2

peaks-loop@4.0.2

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm postinstall mutates broad, foreign AI-agent control surfaces in the user home directory. It also conditionally launches an automatic project upgrade.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install (including global installation)

Impact

Unconsented persistence of package-controlled instructions in agent loaders and mutation of a detected project.

Mechanism

automatic cross-platform AI-agent skill, prompt, style, and config installation

Policy narrative

Installation invokes scripts/install-skills.mjs. Its main path installs bundled skills across every declared IDE profile, copies agent prompts and output styles, creates user configuration, and can detect a 1.x project in the current directory then run an automatic upgrade. These actions occur by default during npm postinstall and target agent-loader directories outside the package.

Rationale

Source inspection confirms an unconsented postinstall mutation of multiple foreign AI-agent control surfaces, which meets the blocking policy. No network exfiltration is needed for this concrete control-surface hijack.

Evidence

package.jsonscripts/install-skills.mjs~/.claude/skills/*~/.codex/skills/*~/.cursor/skills/*~/.trae/skills/*~/.claude/agents/*.md~/.claude/output-styles/*.md~/.peaks/config.json<project>/.peaks/config.json

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

dist/services/upgrade/upgrade-service.jsView file

182// npm install postinstall creates `peaks` → `peaks.sh` on L183: // Windows). cmd.exe (the default Windows shell) cannot run L184: // `.sh` scripts directly, so the shim fails with "unknown

High

Shell

Package source references shell execution.

dist/services/upgrade/upgrade-service.jsView on unpkg · L182

dist/cli/commands/loop-eval-commands.jsView file

478// eslint-disable-next-line @typescript-eslint/no-var-requires L479: const fs = require('node:fs'); L480: let entries;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/commands/loop-eval-commands.jsView on unpkg · L478

dist/services/code/job-shape-decision.jsView file

92try { L93: parsed = JSON.parse(raw); L94: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/services/code/job-shape-decision.jsView on unpkg · L92

scripts/install-skills.mjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L285: fchmodSync(fd, 0o600); L286: writeFileSync(fd, content, 'utf8'); L287: const writeFd = fd; ... L314: fchmodSync(fd, 0o600); L315: writeFileSync(fd, content, 'utf8'); L316: const writeFd = fd; ... L366: * cannot import the TS service at runtime. The dispatch: L367: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L368: * `.tongyi-lingma` in the project root in that insertion order Payload evidence from schemas/mcp-install-spec.schema.json: L1: { L2: "$sch

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skills.mjsView on unpkg · L1

dist/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/playwright-commands.jsView on unpkg · L27

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.14 matchedPath = dist/cli/commands/playwright-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/playwright-commands.jsView on unpkg

dist/services/code-review/ocr-service.jsView file

•matchType = token_shingles matchedPackage = peaks-loop@4.0.0-beta.14 matchedPath = dist/services/code-review/ocr-service.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.14 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/code-review/ocr-service.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.14 matchedPath = [redacted]-service.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/runtime/vendors/codex.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.14 matchedPath = [redacted].js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/codex.jsView on unpkg

dist/services/runtime/vendors/copilot.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.0-beta.14 matchedPath = [redacted].js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.0-beta.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/runtime/vendors/copilot.jsView on unpkg