Loading npm security reports…

warden-ai@0.3.2: AI-agent control-surface risk | LPM Firewall

registry / warden-ai / 0.3.2

warden-ai@0.3.2

The structurally-verified context layer for AI coding agents. Warden sits between your coding agent and its tools, prunes tool output to what the current task needs, and verifies — with real evals — that nothing got worse. 72.3% average token reduction, 1

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently configures Warden across global and project AI-agent control surfaces. It adds MCP servers, rules, hooks, and automatic approvals.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation of warden-ai@0.3.2

Impact

Unconsented persistent execution and approval changes in AI coding-agent clients.

Mechanism

silent postinstall invocation of broad AI-agent configuration and permission mutation

Policy narrative

During npm installation, the package silently invokes `warden init`. That command registers its MCP server in global and project configuration files for many unrelated agent products, writes global rules and project hooks, and enables automatic approvals including Codex tool auto-approval and Cline wildcard approval. This persists a package-controlled executable in AI-agent control surfaces without an explicit user setup command.

Rationale

The behavior is concrete, install-time, unconsented mutation of broad foreign AI-agent control surfaces and permissions. No external exfiltration was needed to establish the blocking condition.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js~/.claude.json~/.cursor/mcp.json~/.codex/config.toml~/.config/devin/config.json<cwd>/.mcp.json<cwd>/.devin/config.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/warden.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = bin/warden.js matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warden.jsView on unpkg

11try { L12: const mod = await import(pathToFileURL(cliPath).href); L13: // dist/cli.js only auto-runs runCli() when it's the direct entry point.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/warden.jsView on unpkg · L11

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 801db858691897a4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = warden-ai@0.3.1 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.cjsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 50-90json

50 "benchmarks/HONEST-NUMBERS.md",

51 "README.md",

52 "LICENSE",

53 "TRADEMARK.md"

54 ],

55 "engines": {

56 "node": ">=22.5.0"

57 },

58 "scripts": {

59 "build": "tsup && tsc --emitDeclarationOnly --outDir dist",

60 "dev": "tsup --watch",

61 "typecheck": "tsc --noEmit",

62 "format": "prettier --write .",

63 "format:check": "prettier --check .",

64 "warden": "tsx src/cli/index.ts",

65 "serve": "tsx src/cli/index.ts serve",

66 "smoke": "tsx src/cli/index.ts status",

67 "test": "vitest run",

68 "test:watch": "vitest",

69 "prepublishOnly": "npm run build",

70 "postinstall": "node bin/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L70

71 },

72 "dependencies": {

73 "@modelcontextprotocol/sdk": "1.29.0",

74 "chalk": "5.6.2",

75 "commander": "15.0.0",

76 "tree-sitter-wasms": "^0.1.13",

77 "web-tree-sitter": "^0.22.6",

78 "zod": "4.4.3"

79 },

80 "devDependencies": {

81 "@types/node": "26.1.1",

82 "prettier": "3.9.5",

83 "puppeteer": "^25.5.0",

84 "tsup": "8.5.1",

85 "tsx": "4.23.1",

86 "typescript": "7.0.2",

87 "vitest": "^4.1.10"

88 }

89}

90

bin/warden.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Warden CLI entrypoint. Delegates to the compiled CLI so the published

3// package works without tsx. In development, run via `npm run warden`.

4import { fileURLToPath } from "node:url";

5import { resolve, dirname } from "node:path";

6import { pathToFileURL } from "node:url"

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 801db858691897a4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = warden-ai@0.3.1 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.cjsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/index.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.3.1 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg