Loading npm security reports…

peaks-loop@4.0.45: AI-agent control-surface risk | LPM Firewall

registry / peaks-loop / 4.0.45

peaks-loop@4.0.45

Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Npm installation automatically modifies AI-agent control surfaces in the user's home directory. It installs skills and agent prompts across multiple vendor directories and can set a Claude output-style default.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package, including npm postinstall execution.

Impact

Package-provided prompts and configuration can influence multiple local AI coding tools without a separate user command.

Mechanism

Automatic cross-platform AI-agent skill, agent, and settings installation.

Policy narrative

On installation, package.json launches scripts/install-skills.mjs. That script creates and writes package-provided AI-agent files under home-directory tool control paths, including Claude, Codex, Cursor, and Trae, and fans out to all configured platforms. It also invokes the agent installer and may set Claude's output-style default. These are automatic mutations of foreign, broad AI-agent control surfaces rather than an explicit setup command.

AI rationale

The automatic postinstall performs broad cross-vendor AI-agent control-surface writes and configuration changes. This meets the install-hook abuse blocking boundary despite the absence of observed network exfiltration.

Evidence

package.jsonscripts/install-skills.mjs~/.claude/skills~/.claude/agents~/.claude/output-styles~/.claude/settings.json~/.codex/skills~/.codex/agents~/.cursor/skills

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/shared/process.jsView file

1import { execFile } from 'node:child_process'; L2: export async function execCommand(command, args, options) {

High

Child Process

Package source references child process execution.

dist/shared/process.jsView on unpkg · L1

dist/cli/commands/test-commands.jsView file

110* A Windows `.cmd`/`.bat` shim cannot be spawned directly (spawn → EINVAL). L111: * The obvious fix, `spawn(shim, argv, { shell: true })`, re-splits argv inside L112: * cmd.exe: a pattern `tests/a b/x.test.ts` arrives as THREE args (measured).

High

Shell

Package source references shell execution.

dist/cli/commands/test-commands.jsView on unpkg · L110

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/test-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/test-commands.jsView on unpkg

dist/cli/commands/governance-classify-contract-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/governance-classify-contract-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/governance-classify-contract-commands.jsView on unpkg

151try { L152: const { execFileSync } = require('node:child_process'); L153: stdout = execFileSync('git', ['diff', '--shortstat', 'HEAD'], {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/commands/governance-classify-contract-commands.jsView on unpkg · L151

dist/services/code/job-shape-decision.jsView file

92try { L93: parsed = JSON.parse(raw); L94: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/services/code/job-shape-decision.jsView on unpkg · L92

scripts/install-skills.mjsView file

1#!/usr/bin/env node L2: import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, readdirSync, renameSync, symlinkSync, un... L3: import { spawnSync } from 'node:child_process'; ... L285: fchmodSync(fd, 0o600); L286: writeFileSync(fd, content, 'utf8'); L287: const writeFd = fd; ... L314: fchmodSync(fd, 0o600); L315: writeFileSync(fd, content, 'utf8'); L316: const writeFd = fd; ... L366: * cannot import the TS service at runtime. The dispatch: L367: * - Look for `.claude`, `.trae`, `.codex`, `.cursor`, `.qoder`, L368: * `.tongyi-lingma` in the project root in that insertion order

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skills.mjsView on unpkg · L1

dist/cli/commands/hooks-commands.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: } if (dryrun) { return { copied: true, source, target }; } mkdirsync(dirname(target), { recursive: true }); copyfilesync(source, target); return { copied: true, source, target }; }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. 'peaks code-gate' } ]; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/hooks-commands.jsView on unpkg

dist/cli/commands/playwright-commands.jsView file

27* The CLI does NOT bundle `playwright-mcp`; it shells out to L28: * `npx playwright-mcp@latest` (G22 / NG3). peaks-loop is the lifecycle L29: * orchestrator, not the install medium. ... L31: import { createHash } from 'node:crypto'; L32: import { spawn } from 'node:child_process'; L33: import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/playwright-commands.jsView on unpkg · L27

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/playwright-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/playwright-commands.jsView on unpkg

bin/peaks.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/peaks.js#virtual:normalized:round1View on unpkg

dist/cli/commands/e2e-verify.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/e2e-verify.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/e2e-verify.jsView on unpkg

dist/cli/commands/vm-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/vm-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/vm-commands.jsView on unpkg

dist/cli/commands/container-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/container-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/container-commands.jsView on unpkg

dist/cli/commands/cron-scheduler-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/cron-scheduler-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/cron-scheduler-commands.jsView on unpkg

dist/cli/commands/worktree-lease-commands.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/cli/commands/worktree-lease-commands.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/worktree-lease-commands.jsView on unpkg

dist/services/artifacts/artifact-service.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = [redacted]-service.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/artifacts/artifact-service.jsView on unpkg

dist/services/dispatch/dispatch-record-writer.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/services/dispatch/dispatch-record-writer.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/dispatch/dispatch-record-writer.jsView on unpkg

dist/services/lint/eslint-runner.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/services/lint/eslint-runner.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/lint/eslint-runner.jsView on unpkg

dist/services/prd/best-practice-auto-trigger.jsView file

•matchType = normalized_sha256 matchedPackage = peaks-loop@4.0.43 matchedPath = dist/services/prd/best-practice-auto-trigger.js matchedIdentity = npm:cGVha3MtbG9vcA:4.0.43 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/prd/best-practice-auto-trigger.jsView on unpkg