Loading npm security reports…

u-foo@2.5.13: AI-agent policy block | LPM Firewall

registry / u-foo / 2.5.13

u-foo@2.5.13

Multi-Agent Workspace Protocol. Just add u. claude → uclaude, codex → ucodex.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm postinstall silently replaces/installs Claude and Codex global agent skill and command entries with package-controlled symlinks. Those instructions influence future agent sessions and include background relay workflows.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install

Impact

Persistently alters Claude/Codex agent behavior outside the installed project.

Mechanism

unconsented postinstall mutation of global AI-agent control surfaces

Policy narrative

Installing the package executes scripts/postinstall.js, which recursively removes colliding global Claude/Codex skill or command paths and replaces them with symlinks to package-controlled instruction files. The installed instructions activate across future agent sessions, including startup and broad ufoo-related prompts; the online skill directs agents to run persistent relay connections. This is unconsented install-time mutation of foreign AI-agent control surfaces.

Rationale

The lifecycle hook modifies global ~/.claude and ~/.codex control directories without a user command, meeting the blocking policy. The absence of a direct network call in the hook does not mitigate the persistent agent-control takeover.

Evidence

package.jsonscripts/postinstall.jsSKILLS/ufoo/SKILL.mdSKILLS/ufoo-online/SKILL.md~/.claude/commands/<skill>.md~/.claude/skills/<skill>${CODEX_HOME:-~/.codex}/skills/<skill>SKILLS/<skill>/SKILL.md

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/ufoo.jsView file

80L81: const { execSync } = require("child_process"); L82: const path = require("path");

High

Child Process

Package source references child process execution.

bin/ufoo.jsView on unpkg · L80

bin/ukimi.jsView file

13L14: const AgentLauncher = require("../src/agents/launch/launcher"); L15: const { resolveDefaultManualBootstrap } = require("../[redacted]");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ukimi.jsView on unpkg · L13

src/runtime/projects/projectId.jsView file

1const crypto = require("crypto"); L2: const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

src/coordination/bus/inject.jsView file

1const { spawn, spawnSync } = require("child_process"); L2: const fs = require("fs"); L3: const net = require("net"); L4: const path = require("path"); ... L7: L8: const SHOULD_LOG_INJECT = process.env.UFOO_INJECT_DEBUG === "1"; L9: const logInject = (message) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/coordination/bus/inject.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/coordination/bus/inject.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/inject.jsView on unpkg

scripts/postinstall.jsView file

62Install-time AI-agent control hijack evidence: L62: function installClaudeCommands(home, sources) { L63: const commandsDir = path.join(home, ".claude", "commands"); L64: fs.mkdirSync(commandsDir, { recursive: true }); L65: ... L73: function installSkillDirs(targetDir, sources, label) { L74: fs.mkdirSync(targetDir, { recursive: true }); L75: ... L83: // Install ufoo skills for Claude and Codex at npm install time. L84: // - Claude slash commands: ~/.claude/commands/<name>.md -> SKILL.md L85: // - Claude skills: ~/.claude/skills/<name> -> skill dir L86: // - Codex skills: ${CODEX_HOME:-~/.codex}/skills/<name> -> skill dir L87: try { Payload evidence from SKILLS/ufoo/SKILL.md: L141: Notes: L142: - Use `--scope private` for helper-internal reports (assistant-like private channel). L143: - `-

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L62

src/runtime/daemon/mcpServer.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/runtime/daemon/mcpServer.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpServer.jsView on unpkg

src/app/chat/transport.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/app/chat/transport.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/app/cli/run.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/coordination/bus/index.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/coordination/bus/index.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 21-61json

21 "ucodex": "bin/ucodex.js",

22 "uagy": "bin/uagy.js",

23 "ukimi": "bin/ukimi.js",

24 "ucode": "bin/ucode.js"

25 },

26 "files": [

27 "bin/",

28 "src/",

29 "templates/",

30 "online/",

31 "scripts/",

32 "SKILLS/",

33 "LICENSE",

34 "README.md"

35 ],

36 "type": "commonjs",

37 "engines": {

38 "node": ">=18"

39 },

40 "scripts": {

41 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "test": "jest",

43 "test:watch": "jest --watch",

44 "test:coverage": "jest --coverage"

45 },

46 "dependencies": {

47 "@anthropic-ai/claude-agent-sdk": "^0.2.138",

48 "@openai/codex-sdk": "^0.130.0",

49 "@xterm/addon-serialize": "^0.14.0",

50 "@xterm/headless": "^6.0.0",

51 "chalk": "^4.1.2",

52 "commander": "^13.1.0",

53 "gray-matter": "^4.0.3",

54 "ink": "^5.2.1",

55 "node-pty": "^1.1.0",

56 "react": "^18.3.1",

57 "ws": "^8.19.0"

58 },

59 "devDependencies": {

60 "jest": "^30.2.0"

61 }

bin/ufoo.jsView file

Lines 60-100javascript

60 }

61 if (cmd === "chat") {

62 await runChat(chatProjectRoot, { globalMode });

63 return;

64 }

65

66 // Handle resume command to resume/launch agent sessions

bin/ukimi.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/**

3 * ukimi: Launch Kimi Code CLI (kimi) and auto-join event bus

4 *

5 * Usage: ukimi [kimi args...]

6 *

7 * Differences vs uclaude:

8 * - kimi has no --append-system-prompt style flag, so the default

9 * bootstrap is delivered via post-launch PTY injection (same model as

10 * ucodex's UFOO_STARTUP_BOOTSTRAP_TEXT path).

11 * - Session resume uses kimi's own session ids via `--session <id>`.

src/runtime/projects/projectId.jsView file

Lines 1-21javascript

1const crypto = require("crypto");

2const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

3const

src/coordination/bus/inject.jsView file

Lines 1-21javascript

1const { spawn, spawnSync } = require("child_process");

2const fs = require("fs");

3const net

scripts/postinstall.jsView file

Lines 42-82javascript

42 sources.push({ name: entry.name, dir: path.join(topSkills, entry.name), md: skillMd });

43 }

44 }

45 }

46 }

47 return sources;

48}

49

50function forceSymlink

src/runtime/daemon/mcpServer.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/runtime/daemon/mcpServer.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpServer.jsView on unpkg

src/app/chat/transport.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/app/chat/transport.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/app/cli/run.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/coordination/bus/index.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.8 matchedPath = src/coordination/bus/index.js matchedIdentity = npm:dS1mb28:2.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg