Loading npm security reports…

workflow-agent-cli@2.23.8: AI-agent control-surface risk | LPM Firewall

registry / workflow-agent-cli / 2.23.8

workflow-agent-cli@2.23.8

A self-evolving workflow management system for AI agent development

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consumer project and writes GitHub Copilot instructions derived from package templates. This is an unconsented foreign AI-agent control-surface write.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation of the package as a local dependency

Impact

Can alter downstream project automation and direct AI agents to perform commits and pushes.

Mechanism

postinstall rewrites package scripts and generates agent instruction files

Policy narrative

Installing the package invokes postinstall. It locates the consuming project, removes or replaces scripts, installs guideline templates, and generates .github/copilot-instructions.md. Those generated instructions incorporate package-controlled templates that mandate workflow actions including committing and pushing changes. This silently changes a foreign AI-agent control surface during installation.

Rationale

The install hook performs unconsented mutation of both the consuming project's package manifest and GitHub Copilot instruction surface. That concrete lifecycle behavior meets the block boundary despite no observed credential exfiltration.

Evidence

package.jsondist/scripts/postinstall.jsdist/chunk-DWHIY7R4.jstemplates/AGENT_EDITING_INSTRUCTIONS.mdconsumer package.jsonconsumer guidelines/consumer .github/copilot-instructions.md

Source & flagged code

5 flagged

package.jsonView file

Lines 33-73json

33 "import": "./dist/config/index.js"

34 }

35 },

36 "bin": {

37 "workflow-agent": "./dist/cli/index.js"

38 },

39 "files": [

40 "dist",

41 "templates",

42 "README.md"

43 ],

44 "scripts": {

45 "build": "tsup",

46 "dev": "tsup --watch",

47 "test": "vitest run",

48 "test:watch": "vitest",

49 "test:coverage": "vitest run --coverage",

50 "lint": "echo \"ESLint not configured - skipping\"",

51 "typecheck": "tsc --noEmit",

52 "clean": "rm -rf dist",

53 "postinstall": "node dist/scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "prepublishOnly": "pnpm build && pnpm test",

55 "workflow": "node dist/cli/index.js",

56 "workflow:version": "node dist/cli/index.js --version",

57 "workflow:init": "node dist/cli/index.js init",

58 "workflow:validate": "node dist/cli/index.js validate",

59 "workflow:config": "node dist/cli/index.js config show",

60 "workflow:config-show": "node dist/cli/index.js config show",

61 "workflow:config-set": "node dist/cli/index.js config set",

62 "workflow:suggest": "node dist/cli/index.js suggest",

63 "workflow:setup": "node dist/cli/index.js setup",

64 "workflow:setup-auto": "node dist/cli/index.js setup auto",

65 "workflow:doctor": "node dist/cli/index.js doctor",

66 "workflow:scope": "node dist/cli/index.js scope list",

67 "workflow:scope-list": "node dist/cli/index.js scope list",

68 "workflow:scope-create": "node dist/cli/index.js scope create",

69 "workflow:scope-migrate": "node dist/cli/index.js scope migrate",

70 "workflow:scope-hooks": "node dist/cli/index.js scope hooks status",

71 "workflow:scope-hooks-install": "node dist/cli/index.js scope hooks install",

72 "workflow:scope-hooks-uninstall": "node dist/cli/index.js scope hooks uninstall",

73 "workflow:scope-hooks-test": "node dist/cli/index.js scope hooks test",

dist/chunk-WK7D2AVV.jsView file

Lines 194-234javascript

194 );

195 return {

196 valid: false,

197 scannedFiles: 0,

198 totalReferences: 0,

199 brokenReferences: [],

200 errors

201 };

dist/chunk-JRXA6XDA.jsView file

•matchType = malicious_source_fingerprint_signature signature = 87a582d00f6eb3ad signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = workflow-agent-cli@2.23.7 matchedPath = dist/chunk-JRXA6XDA.js matchedIdentity = npm:d29ya2Zsb3ctYWdlbnQtY2xp:2.23.7 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/chunk-JRXA6XDA.jsView on unpkg