universal-ast-mapper@2.0.11: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

universal-ast-mapper@2.0.11: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/security.jsView file

8severity: "critical", L9: message: "Use of eval() allows arbitrary code execution", L10: // matches eval( but not eval.toString( or eval.call(

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security.jsView on unpkg · L8

dist/plugins.jsView file

17// URL scheme and rejects it (ERR_UNSUPPORTED_ESM_URL_SCHEME). L18: const mod = await import(pathToFileURL(abs).href); L19: const plugin = "default" in mod && isPlugin(mod.default) ? mod.default

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins.jsView on unpkg · L17

dist/diskcache.jsView file

38const raw = fs.readFileSync(shardPath(cacheDir, key), "utf8"); L39: const parsed = JSON.parse(raw); L40: return parsed.skel ?? null;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/diskcache.jsView on unpkg · L38

scripts/install-skill.mjsView file

2/** L3: * Postinstall: copies the /ast-map Claude Code skill to ~/.claude/skills/ast-map/ L4: * so it appears in the / command palette automatically after install. ... L147: L148: // ─── CLAUDE.md entry ────────────────────────────────────────────────────────── L149: ... L151: # ast-map L152: - **ast-map** (\`~/.claude/skills/ast-map/SKILL.md\`) - AST-based code analysis: dead code, circular deps, blast radius, architecture validation, symbol search. Trigger: \`/ast-map... L153: When the user types \`/ast-map\`, invoke the Skill tool with \`skill: "ast-map"\` before doing anything else. ... L158: function main() { L159: const claudeDir = path.join(os.homedir(), ".claude"); L160:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L2

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ings). show file + rule + message. - **skeleton**: show symbols as a tree with line ranges. - **impact**: show direct and transitive file lists + totalfiles count. - **calls**: show call list with line numbers + whether external. - **search**: show file + symbol + kind + line range. always end with a relevant follow-up offer: - found dead code? → "want me to verify each one with \`impact\` before deleting?" - found cycles? → "want me to show which import to break to resolve the shortest cycle?" - found god nodes? → "want me to check the blast radius of the top one?" --- ## examples ### /ast-map runs dead + cycles + top on the current directory — a 30-second a

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/install-skill.mjs

Source & flagged code

6 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "universal-ast-mapper": "dist/index.js",

9 "ast-map": "dist/cli.js",

10 "ast-map-lsp": "dist/lsp.js"

11 },

12 "files": [

13 "dist",

14 "scripts",

15 "README.md",

16 "CHANGELOG.md",

17 "BLUEPRINT.md"

18 ],

19 "scripts": {

20 "prepare": "npm run build",

21 "build": "tsc",

22 "start": "node dist/index.js",

23 "smoke": "node test/smoke.mjs",

24 "test": "node test/run-all.mjs",

25 "postinstall": "node scripts/install-skill.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

26 },

27 "engines": {

28 "node": ">=18"

29 },

30 "keywords": [

31 "mcp",

32 "ast",

33 "tree-sitter",

34 "code-map",

35 "skeleton"

36 ],

37 "license": "MIT",

38 "dependencies": {

39 "@modelcontextprotocol/sdk": "^1.29.0",

40 "commander": "^14.0.3",

41 "tree-sitter-wasms": "0.1.13",

42 "web-tree-sitter": "0.21.0",

43 "zod": "^3.23.8"

44 },

45 "devDependencies": {

dist/security.jsView file

Lines 1-28javascript

1// ─── Static security scanner ──────────────────────────────────────────────────

2// Line-by-line regex scanning — no AST needed. Finds dangerous patterns

3// in source code across JavaScript, TypeScript, Python, etc.

4// ─── Rule definitions ─────────────────────────────────────────────────────────

5export const SECURITY_RULES = [

6 {

7 id: "eval",

dist/plugins.jsView file

Lines 1-37javascript

1import fs from "node:fs";

2import path from "node:path";

3import { pathToFileURL } from "node:url";

4// ─── Loader ───────────────────────────────────────────────────────────────────

5const PLUGINS_DIR

dist/diskcache.jsView file

Lines 18-58javascript

18/** Conventional cache location for a project root. */

19export function defaultCacheDir(root) {

20 return path.join(root, ".ast-map", "cache");

21}

22/** Stable cache key for a (source, detail, schema, grammar) tuple. */

23

scripts/install-skill.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * Postinstall: copies the /ast-map Claude Code skill to ~/.claude/skills/ast-map/

4 * so it appears in the / command palette automatically after install.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L2

5 * Skips silently if Claude Code is not installed or if running in CI.

6 */

7import fs from