registry / AI-agent control-surface risk / universal-ast-mapper

universal-ast-mapper

MCP server that maps source files into a normalized code skeleton (JSON + HTML) using tree-sitter.

This report shows the evidence for universal-ast-mapper@2.0.11. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic postinstall performs persistent writes to the user's global Claude Code configuration and injects behavior-bearing instructions. This meets the install-control-surface blocking policy even though no exfiltration was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation in a non-CI environment where ~/.claude exists

Impact

It can change how Claude Code responds to /ast-map in future sessions.

Mechanism

postinstall writes a Claude skill and appends agent instructions

Policy narrative

On npm installation, package.json launches scripts/install-skill.mjs. When a Claude Code directory exists, the script creates a global ast-map skill and appends a CLAUDE.md instruction requiring the agent to invoke that skill before other work for /ast-map. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

Evidence

package.jsonscripts/install-skill.mjs~/.claude/skills/ast-map/SKILL.md~/.claude/CLAUDE.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs an automatic postinstall script.
The postinstall targets the user's Claude Code directory and writes a new skill.
The same automatic script appends instructions to CLAUDE.md that require invoking its skill before other work.

Evidence against

The installer skips CI environments and returns when the Claude directory does not exist.
No credential collection, data exfiltration, or remote payload download was found in the install script.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 804 KB of source, external domains: api.example.com, cdn.jsdelivr.net, github.com

Source & flagged code

6 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "universal-ast-mapper": "dist/index.js",

9 "ast-map": "dist/cli.js",

10 "ast-map-lsp": "dist/lsp.js"

11 },

12 "files": [

13 "dist",

14 "scripts",

15 "README.md",

16 "CHANGELOG.md",

17 "BLUEPRINT.md"

18 ],

19 "scripts": {

20 "prepare": "npm run build",

21 "build": "tsc",

22 "start": "node dist/index.js",

23 "smoke": "node test/smoke.mjs",

24 "test": "node test/run-all.mjs",

25 "postinstall": "node scripts/install-skill.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "keywords": [

31 "mcp",

32 "ast",

33 "tree-sitter",

34 "code-map",

35 "skeleton"

36 ],

37 "license": "MIT",

38 "dependencies": {

39 "@modelcontextprotocol/sdk": "^1.29.0",

40 "commander": "^14.0.3",

41 "tree-sitter-wasms": "0.1.13",

42 "web-tree-sitter": "0.21.0",

43 "zod": "^3.23.8"

44 },

45 "devDependencies": {

dist/security.jsView file

Lines 1-28javascript

1// ─── Static security scanner ──────────────────────────────────────────────────

2// Line-by-line regex scanning — no AST needed. Finds dangerous patterns

3// in source code across JavaScript, TypeScript, Python, etc.

4// ─── Rule definitions ─────────────────────────────────────────────────────────

5export const SECURITY_RULES = [

6 {

7 id: "eval",

dist/plugins.jsView file

Lines 1-37javascript

1import fs from "node:fs";

2import path from "node:path";

3import { pathToFileURL } from "node:url";

4// ─── Loader ───────────────────────────────────────────────────────────────────

5const PLUGINS_DIR

dist/diskcache.jsView file

Lines 18-58javascript

18/** Conventional cache location for a project root. */

19export function defaultCacheDir(root) {

20 return path.join(root, ".ast-map", "cache");

21}

22/** Stable cache key for a (source, detail, schema, grammar) tuple. */

scripts/install-skill.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * Postinstall: copies the /ast-map Claude Code skill to ~/.claude/skills/ast-map/

4 * so it appears in the / command palette automatically after install.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L2

5 * Skips silently if Claude Code is not installed or if running in CI.

6 */

7import fs from

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/security.jsView file

8severity: "critical", L9: message: "Use of eval() allows arbitrary code execution", L10: // matches eval( but not eval.toString( or eval.call(

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security.jsView on unpkg · L8

dist/plugins.jsView file

17// URL scheme and rejects it (ERR_UNSUPPORTED_ESM_URL_SCHEME). L18: const mod = await import(pathToFileURL(abs).href); L19: const plugin = "default" in mod && isPlugin(mod.default) ? mod.default

Findings

1 Critical2 High4 Medium8 Low

CriticalAi Agent Control Hijackscripts/install-skill.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/install-skill.mjs

MediumDynamic Requiredist/plugins.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/security.js

LowWeak Cryptodist/diskcache.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Affected versions and remediation

This report applies to universal-ast-mapper@2.0.11.

The versions list below shows the verdict for each recorded version.

Avoid installing universal-ast-mapper@2.0.11. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-09 22:45:53.136Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

2.0.11latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 9, 2026, 12:48 PM 2.0.10MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 9, 2026, 12:28 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages