Loading npm security reports…

warden-ai@0.5.0: AI-agent control-surface risk | LPM Firewall

registry / warden-ai / 0.5.0

warden-ai@0.5.0

The structurally-verified context layer for AI coding agents. Warden sits between your coding agent and its tools, prunes tool output to what the current task needs, and verifies — with real evals — that nothing got worse. 72.3% average token reduction, 1

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation silently launches `warden init` in the consuming project. That command persists a Warden MCP server across global and project AI-agent configurations, enables automatic tool approval, and installs agent hooks.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Unconsented modification of broad AI-agent control surfaces can route future agent actions through the package with approvals enabled.

Mechanism

silent cross-agent MCP registration, approval escalation, and hook installation

Policy narrative

Installing the package invokes a silent postinstall hook that runs `warden init` in the victim project's working directory. Init registers the package as an MCP server in multiple global and project AI-agent configurations, sets Codex Warden tools to automatic approval, grants wildcard Cline/Roo approval, rewrites agent rules, and installs pre-tool hooks redirecting file-read and search operations. These mutations occur without an explicit user command or consent and persist beyond installation.

Rationale

This is a concrete unconsented postinstall mutation of broad foreign AI-agent control surfaces, including approval escalation and command hooks. It meets the firewall block boundary regardless of the lack of observed exfiltration.

Evidence

package.jsonbin/postinstall.cjsdist/cli.js~/.claude.json~/.cursor/mcp.json~/.cursor/permissions.json~/.codex/config.toml

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/warden.jsView file

22// Compiled output not present — fall back to tsx for dev convenience. L23: const { spawn } = await import("node:child_process"); L24: const src = resolve(here, "..", "src", "cli", "index.ts");

High

Child Process

Package source references child process execution.

bin/warden.jsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = warden-ai@0.4.2 matchedPath = bin/warden.js matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/warden.jsView on unpkg

11try { L12: const mod = await import(pathToFileURL(cliPath).href); L13: // dist/cli.js only auto-runs runCli() when it's the direct entry point.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/warden.jsView on unpkg · L11

dist/index.jsView file

20Cross-file remote execution chain: dist/index.js spawns dist/cli.js; helper contains network access plus dynamic code execution. L20: import { fileURLToPath } from "url"; L21: var getFilename, getDirname, __dirname; L22: var init_esm_shims = __esm({ ... L612: init_guard(); L613: HEADER_RE = /^\s*(export\s+)?(async\s+)?(function|class|def|interface|type|enum|struct|impl|pub fn|fn|const|public|private|protected|static)\b.*$/; L614: IMPORT_RE = /^\s*(import\s+|from\s+\S+\s+import\s+|export\s+.*\s+from\s+|use\s+\S+::|#include\s+|require\s*\()/; ... L1953: function currentLevel() { L1954: const env = (process.env.WARDEN_DEBUG ?? "").toLowerCase(); L1955: if (env === "1" || env === "true" || env === "debug") return LEVELS.debug; ... L2044: try { L2045: parsed = JSON.parse(trimmed); L2046: } catc

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L20

•matchType = normalized_sha256 matchedPackage = warden-ai@0.4.2 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.4.2 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1da75682d90f2f56 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = warden-ai@0.4.2 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.cjsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.4.2 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 50-90json

50 "benchmarks/HONEST-NUMBERS.md",

51 "README.md",

52 "LICENSE",

53 "TRADEMARK.md"

54 ],

55 "engines": {

56 "node": ">=22.5.0"

57 },

58 "scripts": {

59 "build": "tsup && tsc --emitDeclarationOnly --outDir dist",

60 "dev": "tsup --watch",

61 "typecheck": "tsc --noEmit",

62 "format": "prettier --write .",

63 "format:check": "prettier --check .",

64 "warden": "tsx src/cli/index.ts",

65 "serve": "tsx src/cli/index.ts serve",

66 "smoke": "tsx src/cli/index.ts status",

67 "test": "vitest run",

68 "test:watch": "vitest",

69 "prepublishOnly": "npm run build",

70 "postinstall": "node bin/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L70

71 },

72 "dependencies": {

73 "@modelcontextprotocol/sdk": "1.29.0",

74 "chalk": "5.6.2",

75 "commander": "15.0.0",

76 "tree-sitter-wasms": "^0.1.13",

77 "web-tree-sitter": "^0.22.6",

78 "zod": "4.4.3"

79 },

80 "devDependencies": {

81 "@types/node": "26.1.1",

82 "prettier": "3.9.5",

83 "puppeteer": "^25.5.0",

84 "tsup": "8.5.1",

85 "tsx": "4.23.1",

86 "typescript": "7.0.2",

87 "vitest": "^4.1.10"

88 }

89}

90

bin/warden.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Warden CLI entrypoint. Delegates to the compiled CLI so the published

3// package works without tsx. In development, run via `npm run warden`.

4import { fileURLToPath } from "node:url";

5import { resolve, dirname } from "node:path";

6import { pathToFileURL } from "node:url"

dist/index.jsView file

Lines 1-40javascript

1// warden — provably-safe context layer for AI coding agents

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined"

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.4.2 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1da75682d90f2f56 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = warden-ai@0.4.2 matchedPath = bin/postinstall.cjs matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.cjsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = warden-ai@0.4.2 matchedPath = dist/cli.js matchedIdentity = npm:d2FyZGVuLWFp:0.4.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg