Loading npm security reports…

warden-ai@0.1.5: AI-agent control-surface risk | LPM Firewall

registry / warden-ai / 0.1.5

warden-ai@0.1.5

The structurally-verified context layer for AI coding agents. Warden sits between your coding agent and its tools, prunes tool output to what the current task needs, and verifies — with real evals — that nothing got worse.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically modifies broad, foreign AI-agent control surfaces. It registers a Warden MCP server, writes rules, and can rewrite existing project instruction files without an explicit user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of warden-ai@0.1.5

Impact

Future AI-agent sessions can automatically launch the package's MCP server and consume altered instruction/configuration files.

Mechanism

silent postinstall invocation of broad MCP registration and agent-file mutation

Policy narrative

Installing the package triggers a hidden `warden init` command. That command registers the package as an MCP server across numerous unrelated AI-agent configurations, writes project/global rules, and compresses existing agent instruction files. These broad control-surface changes occur without an explicit setup command or visible installation output.

Rationale

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the blocking policy. No exfiltration is needed for this lifecycle hijack to be harmful.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js$HOME/.claude.json$HOME/.codex/config.toml$HOME/.cursor/mcp.json<project>/.mcp.json<project>/CLAUDE.md<project>/AGENTS.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/warden.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = bin/warden.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warden.jsView on unpkg

11try { L12: const mod = await import(pathToFileURL(cliPath).href); L13: // dist/cli.js only auto-runs runCli() when it's the direct entry point.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/warden.jsView on unpkg · L11

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8fe78156802d7dea signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = warden-ai@0.2.5 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 43-82json

43 "bin",

44 "README.md",

45 "LICENSE",

46 "TRADEMARK.md"

47 ],

48 "engines": {

49 "node": ">=22.5.0"

50 },

51 "scripts": {

52 "build": "tsup && tsc --emitDeclarationOnly --outDir dist",

53 "dev": "tsup --watch",

54 "typecheck": "tsc --noEmit",

55 "format": "prettier --write .",

56 "format:check": "prettier --check .",

57 "warden": "tsx src/cli/index.ts",

58 "serve": "tsx src/cli/index.ts serve",

59 "smoke": "tsx src/cli/index.ts status",

60 "test": "vitest run",

61 "test:watch": "vitest",

62 "prepublishOnly": "npm run build",

63 "postinstall": "node bin/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L63

64 },

65 "dependencies": {

66 "@modelcontextprotocol/sdk": "1.29.0",

67 "chalk": "5.6.2",

68 "commander": "15.0.0",

69 "tree-sitter-wasms": "^0.1.13",

70 "web-tree-sitter": "^0.22.6",

71 "zod": "4.4.3"

72 },

73 "devDependencies": {

74 "@types/node": "26.1.1",

75 "prettier": "3.9.5",

76 "tsup": "8.5.1",

77 "tsx": "4.23.1",

78 "typescript": "7.0.2",

79 "vitest": "^4.1.10"

80 }

81}

82

bin/warden.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Warden CLI entrypoint. Delegates to the compiled CLI so the published

3// package works without tsx. In development, run via `npm run warden`.

4import { fileURLToPath } from "node:url";

5import { resolve, dirname } from "node:path";

6import { pathToFileURL } from "node:url"

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8fe78156802d7dea signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = warden-ai@0.2.5 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg