Loading npm security reports…

warden-ai@0.2.7: AI-agent control-surface risk | LPM Firewall

registry / warden-ai / 0.2.7

warden-ai@0.2.7

The structurally-verified context layer for AI coding agents. Warden sits between your coding agent and its tools, prunes tool output to what the current task needs, and verifies — with real evals — that nothing got worse.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time execution silently mutates broad AI-agent control surfaces and project instruction files. It registers a persistent MCP server and rewrites/compresses agent memory files.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install executes postinstall

Impact

Unconsented persistence across Codex, Claude, Cursor, Windsurf/Devin, Cline, Roo, Continue, and project configurations; project instruction files may be rewritten.

Mechanism

postinstall invokes broad MCP registration and agent-rule mutation

Policy narrative

During npm installation, the postinstall hook silently executes `dist/cli.js init --skip-index` in the consumer's working directory. That command registers Warden as an MCP server in numerous global and project AI-agent configurations, writes global and project rule files, and compresses existing agent instruction files without user consent.

Rationale

This is a concrete unconsented postinstall mutation of foreign, broad AI-agent control surfaces, meeting the blocking policy. No external exfiltration was needed to establish the harmful install-time behavior.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js$HOME/.codex/config.toml$HOME/.claude.json$HOME/.cursor/mcp.json./.mcp.json./CLAUDE.md./AGENTS.md

Decision evidence

Source & flagged code

6 flagged

package.jsonView file

Lines 44-84json

44 "docs/assets/warden-banner.png",

45 "README.md",

46 "LICENSE",

47 "TRADEMARK.md"

48 ],

49 "engines": {

50 "node": ">=22.5.0"

51 },

52 "scripts": {

53 "build": "tsup && tsc --emitDeclarationOnly --outDir dist",

54 "dev": "tsup --watch",

55 "typecheck": "tsc --noEmit",

56 "format": "prettier --write .",

57 "format:check": "prettier --check .",

58 "warden": "tsx src/cli/index.ts",

59 "serve": "tsx src/cli/index.ts serve",

60 "smoke": "tsx src/cli/index.ts status",

61 "test": "vitest run",

62 "test:watch": "vitest",

63 "prepublishOnly": "npm run build",

64 "postinstall": "node bin/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L64

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L64

65 },

66 "dependencies": {

67 "@modelcontextprotocol/sdk": "1.29.0",

68 "chalk": "5.6.2",

69 "commander": "15.0.0",

70 "tree-sitter-wasms": "^0.1.13",

71 "web-tree-sitter": "^0.22.6",

72 "zod": "4.4.3"

73 },

74 "devDependencies": {

75 "@types/node": "26.1.1",

76 "prettier": "3.9.5",

77 "puppeteer": "^25.5.0",

78 "tsup": "8.5.1",

79 "tsx": "4.23.1",

80 "typescript": "7.0.2",

81 "vitest": "^4.1.10"

82 }

83}

84

bin/warden.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Warden CLI entrypoint. Delegates to the compiled CLI so the published

3// package works without tsx. In development, run via `npm run warden`.

4import { fileURLToPath } from "node:url";

5import { resolve, dirname } from "node:path";

6import { pathToFileURL } from "node:url"

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.2.5 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = warden-ai@0.2.6 matchedIdentity = npm:d2FyZGVuLWFp:0.2.6 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg