registry / warden-ai / 0.3.0

warden-ai@0.3.0

The structurally-verified context layer for AI coding agents. Warden sits between your coding agent and its tools, prunes tool output to what the current task needs, and verifies — with real evals — that nothing got worse. 72.3% average token reduction, 1

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation silently runs setup that modifies global and project AI-agent configurations. It registers an MCP server, enables automatic approval for it, and redirects agent read/search hooks.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Persistent alteration of Codex, Claude, Cursor, and other agent control surfaces; Warden commands may run with auto-approved tools.

Mechanism

Unconsented cross-agent MCP registration and hook/permission mutation

Policy narrative

Installing the package triggers a suppressed `warden init` without a user command. That initializer writes MCP registrations across global and project agent configurations, configures Codex automatic tool approval, and installs PreToolUse redirects for Claude/Devin. This is unconsented install-time mutation of broad foreign AI-agent control surfaces.

Rationale

The lifecycle chain is concrete and automatic: postinstall invokes initialization that persists registrations, approval changes, and enforcement hooks across unrelated AI-agent configurations. This meets the blocking policy for unconsented postinstall control-surface mutation.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js~/.claude.json~/.codex/config.toml~/.cursor/mcp.json~/.cursor/permissions.json.mcp.json.claude/settings.json.devin/hooks.v1.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall silently executes `warden init` during npm installation.
Init registers Warden in global and project AI-agent MCP configurations.
Codex registration sets automatic tool approval.
Init writes PreToolUse hooks that redirect built-in read/search tools to Warden.

Evidence against

No network endpoint or credential-exfiltration path was identified in the inspected lifecycle chain.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 949 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 50-90json

50 "benchmarks/HONEST-NUMBERS.md",

51 "README.md",

52 "LICENSE",

53 "TRADEMARK.md"

54 ],

55 "engines": {

56

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/warden.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.1.5 matchedPath = bin/warden.js matchedIdentity = npm:d2FyZGVuLWFp:0.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warden.jsView on unpkg

Findings

3 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/warden.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/warden.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

LPM CLI

11try { L12: const mod = await import(pathToFileURL(cliPath).href); L13: // dist/cli.js only auto-runs runCli() when it's the direct entry point.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/warden.jsView on unpkg · L11

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.1.5 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → warden

Runtimenode >=22.5.0

Artifact3.14 MB · 116 files1 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsNoLicense

Source & flagged code

5 flagged

package.jsonView file

Lines 50-90json

50 "benchmarks/HONEST-NUMBERS.md",

51 "README.md",

52 "LICENSE",

53 "TRADEMARK.md"

54 ],

55 "engines": {

56

"node"

:

">=22.5.0"

57 },

58 "scripts": {

59 "build": "tsup && tsc --emitDeclarationOnly --outDir dist",

60 "dev": "tsup --watch",

61 "typecheck": "tsc --noEmit",

62 "format": "prettier --write .",

63 "format:check": "prettier --check .",

64 "warden": "tsx src/cli/index.ts",

65 "serve": "tsx src/cli/index.ts serve",

66 "smoke": "tsx src/cli/index.ts status",

67 "test": "vitest run",

68 "test:watch": "vitest",

69 "prepublishOnly": "npm run build",

70 "postinstall": "node bin/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L70

71 },

72 "dependencies": {

73 "@modelcontextprotocol/sdk": "1.29.0",

74 "chalk": "5.6.2",

75 "commander": "15.0.0",

76 "tree-sitter-wasms": "^0.1.13",

77 "web-tree-sitter": "^0.22.6",

78 "zod": "4.4.3"

79 },

80 "devDependencies": {

81 "@types/node": "26.1.1",

82 "prettier": "3.9.5",

83 "puppeteer": "^25.5.0",

84 "tsup": "8.5.1",

85 "tsx": "4.23.1",

86 "typescript": "7.0.2",

87 "vitest": "^4.1.10"

88 }

89}

90

bin/warden.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Warden CLI entrypoint. Delegates to the compiled CLI so the published

3// package works without tsx. In development, run via `npm run warden`.

4import { fileURLToPath } from "node:url";

5import { resolve, dirname } from "node:path";

6import { pathToFileURL } from "node:url"

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.1.5 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

;

7

8const here = dirname(fileURLToPath(import.meta.url));

9const cliPath = resolve(here, "..", "dist", "cli.js");

10

11try {

12 const mod = await import(pathToFileURL(cliPath).href);

13 // dist/cli.js only auto-runs runCli() when it's the direct entry point.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/warden.jsView on unpkg · L11

14 // Since we're importing it, we need to call runCli() explicitly.

15 if (typeof mod.runCli === "function") {

16 mod.runCli().catch((err) => {

17 console.error("warden: fatal:", err?.message ?? String(err));

18 process.exit(1);

19 });

20 }

21} catch (err) {

22 // Compiled output not present — fall back to tsx for dev convenience.

23 const { spawn } = await import("node:child_process");

24 const src = resolve(here, "..", "src", "cli", "index.ts");

25 const child = spawn(

26 process.platform === "win32" ? "npx.cmd" : "npx",

27 ["tsx", src, ...process.argv.slice(2)],

28 { stdio: "inherit", shell: false },

29 );

30 child.on("exit", (code) => process.exit(code ?? 1));

31}

•matchType = normalized_sha256 matchedPackage = warden-ai@0.1.5 matchedPath = bin/warden.js matchedIdentity = npm:d2FyZGVuLWFp:0.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warden.jsView on unpkg