Loading npm security reports…

u-foo@2.5.8: AI-agent policy block | LPM Firewall

registry / u-foo / 2.5.8

u-foo@2.5.8

Multi-Agent Workspace Protocol. Just add u. claude → uclaude, codex → ucodex.

AI Security Review

scanned 19h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. On npm install, the package silently installs its own Claude and Codex instruction/skill files into user-wide agent-control directories. It deletes existing same-named paths first, then symlinks package-controlled instructions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install executes postinstall

Impact

Future Claude/Codex sessions can load package-supplied instructions; existing targets may be removed.

Mechanism

unconsented global AI-agent control-surface mutation

Policy narrative

Installing the package invokes scripts/postinstall.js without a user command. It creates global Claude and Codex skill directories, recursively deletes any conflicting targets, and symlinks package-controlled SKILL.md content into those foreign agent control surfaces. The installed ufoo skill explicitly targets agent-session startup, creating persistent instruction injection into future sessions. The package also contains code to read provider credentials and make authenticated upstream requests.

Rationale

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces, including destructive replacement of existing paths. That meets the blocking policy independent of the scanner label.

Evidence

package.jsonscripts/postinstall.jsSKILLS/ufoo/SKILL.mdsrc/agents/providers/credentials/codex.jssrc/agents/providers/credentials/claude.jssrc/agents/providers/upstreamTransport.js

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/ufoo.jsView file

80L81: const { execSync } = require("child_process"); L82: const path = require("path");

High

Child Process

Package source references child process execution.

bin/ufoo.jsView on unpkg · L80

bin/uagy.jsView file

20L21: const AgentLauncher = require("../src/agents/launch/launcher"); L22: const { resolveDefaultManualBootstrap } = require("../[redacted]");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/uagy.jsView on unpkg · L20

src/runtime/projects/projectId.jsView file

1const crypto = require("crypto"); L2: const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

src/coordination/bus/inject.jsView file

1const { spawn, spawnSync } = require("child_process"); L2: const fs = require("fs"); L3: const net = require("net"); L4: const path = require("path"); ... L7: L8: const SHOULD_LOG_INJECT = process.env.UFOO_INJECT_DEBUG === "1"; L9: const logInject = (message) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/coordination/bus/inject.jsView on unpkg · L1

scripts/postinstall.jsView file

62Install-time AI-agent control hijack evidence: L62: function installClaudeCommands(home, sources) { L63: const commandsDir = path.join(home, ".claude", "commands"); L64: fs.mkdirSync(commandsDir, { recursive: true }); L65: ... L73: function installSkillDirs(targetDir, sources, label) { L74: fs.mkdirSync(targetDir, { recursive: true }); L75: ... L83: // Install ufoo skills for Claude and Codex at npm install time. L84: // - Claude slash commands: ~/.claude/commands/<name>.md -> SKILL.md L85: // - Claude skills: ~/.claude/skills/<name> -> skill dir L86: // - Codex skills: ${CODEX_HOME:-~/.codex}/skills/<name> -> skill dir L87: try { Payload evidence from SKILLS/ufoo/SKILL.md: L141: Notes: L142: - Use `--scope private` for helper-internal reports (assistant-like private channel). L143: - `-

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L62

src/runtime/daemon/mcpServer.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/runtime/daemon/mcpServer.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpServer.jsView on unpkg

src/agents/launch/launcher.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/agents/launch/launcher.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/launcher.jsView on unpkg

src/app/chat/transport.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/app/chat/transport.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/app/cli/run.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/coordination/bus/index.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/coordination/bus/index.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 20-60json

20 "uclaude": "bin/uclaude.js",

21 "ucodex": "bin/ucodex.js",

22 "uagy": "bin/uagy.js",

23 "ucode": "bin/ucode.js"

24 },

25 "files": [

26 "bin/",

27 "src/",

28 "templates/",

29 "online/",

30 "scripts/",

31 "SKILLS/",

32 "LICENSE",

33 "README.md"

34 ],

35 "type": "commonjs",

36 "engines": {

37 "node": ">=18"

38 },

39 "scripts": {

40 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "test": "jest",

42 "test:watch": "jest --watch",

43 "test:coverage": "jest --coverage"

44 },

45 "dependencies": {

46 "@anthropic-ai/claude-agent-sdk": "^0.2.138",

47 "@openai/codex-sdk": "^0.130.0",

48 "@xterm/addon-serialize": "^0.14.0",

49 "@xterm/headless": "^6.0.0",

50 "chalk": "^4.1.2",

51 "commander": "^13.1.0",

52 "gray-matter": "^4.0.3",

53 "ink": "^5.2.1",

54 "node-pty": "^1.1.0",

55 "react": "^18.3.1",

56 "ws": "^8.19.0"

57 },

58 "devDependencies": {

59 "jest": "^30.2.0"

60 }

bin/ufoo.jsView file

Lines 60-100javascript

60 }

61 if (cmd === "chat") {

62 await runChat(chatProjectRoot, { globalMode });

63 return;

64 }

65

66 // Handle resume command to resume/launch agent sessions

bin/uagy.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * uagy: Launch Antigravity CLI (agy) and auto-join the ufoo event bus.

4 *

5 * Usage: uagy [agy args...]

6 *

7 * Differences vs ucodex / uclaude:

8 * - agy is authenticated via Google OAuth + the OS keyring; ufoo does NOT

9 * manage credentials. Requires an account that is eligible for

10 * Antigravity (18+, supported region).

11 * - Model selection is in-REPL via `/model` (no command-line flag),

src/runtime/projects/projectId.jsView file

Lines 1-21javascript

1const crypto = require("crypto");

2const fs = require("fs");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/runtime/projects/projectId.jsView on unpkg · L1

3const

src/coordination/bus/inject.jsView file

Lines 1-21javascript

1const { spawn, spawnSync } = require("child_process");

2const fs = require("fs");

3const net

scripts/postinstall.jsView file

Lines 42-82javascript

42 sources.push({ name: entry.name, dir: path.join(topSkills, entry.name), md: skillMd });

43 }

44 }

45 }

46 }

47 return sources;

48}

49

50function forceSymlink

src/runtime/daemon/mcpServer.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/runtime/daemon/mcpServer.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/runtime/daemon/mcpServer.jsView on unpkg

src/agents/launch/launcher.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/agents/launch/launcher.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/agents/launch/launcher.jsView on unpkg

src/app/chat/transport.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/app/chat/transport.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/chat/transport.jsView on unpkg

src/app/cli/run.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/app/cli/run.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/app/cli/run.jsView on unpkg

src/coordination/bus/index.jsView file

•matchType = normalized_sha256 matchedPackage = u-foo@2.5.6 matchedPath = src/coordination/bus/index.js matchedIdentity = npm:dS1mb28:2.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/coordination/bus/index.jsView on unpkg