Package Lifecycle Script Writes Agent Memory/Instruction Store
Installing a package with npm, pnpm, yarn or bun can trigger a hidden setup step that drops files into an AI agent's memory or instruction folders, such as ~/.claude/skills or ~/.codex. Because agents re-read those folders on every future run, this gives an attacker a way to plant standing instructions the agent will later follow, all through a routine package install.
How the attack works
A developer or CI job runs a normal package install command (npm install, yarn, pnpm, bun, or npx). A lifecycle script bundled with that package - or a binary shipped inside node_modules - runs automatically as part of the install and spawns further processes. One of those processes writes files into an AI agent's memory, instruction, or skills directory (paths like ~/.claude/skills, ~/.codex, ~/.gemini, or .mcp.json), sometimes registering a new named capability. The agent later reads those files as instructions on every subsequent invocation, so the attacker gets persistent influence over the agent's behavior without ever touching it directly.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c3f1d2a-9b64-4e18-a5d7-2f0c6b81e4a3
- Severity
- High
Why it matters
An attacker can use a compromised or malicious npm/pnpm/yarn/bun package to plant instructions that an AI agent will silently obey from then on, effectively hijacking agent behavior through a supply-chain foothold rather than a one-time exploit.
What you can do
- →Review what postinstall/lifecycle scripts your dependencies run before installing them, and pin or vet packages that touch agent memory, skill, or MCP config directories.
- →Treat any new files appearing in agent memory/instruction/skill folders (~/.claude, ~/.codex, ~/.gemini, *.mcp.json) right after a package install as suspicious until confirmed to be part of an intentional plugin setup.
- →Restrict write access to agent memory/instruction directories so only explicit, user-approved setup steps can modify them.
- →When triaging an alert, check the package name and install command in the lineage to confirm whether the write was part of a known, approved agent plugin's documented install step.
Known benign look-alikes
- Legitimate, user-approved agent plugin packages installed from npm that intentionally write skills or prompt files into ~/.claude/skills, ~/.codex or ~/.gemini as part of their documented setup step. These will be reported once per install burst; triage by confirming the package name in the Supply-Chain Delivery stage command line.
- An MCP server package whose postinstall step writes or patches a .mcp.json / mcp_settings.json entry during a deliberate developer install.
- A monorepo bootstrap (pnpm install / yarn install) that runs a workspace prepare script which copies documentation markdown into a shared user data directory whose path happens to contain a memory/prompt/skill token.
- Reinstall or upgrade of an already-trusted agent toolkit, which repeats the same fan-out of markdown files into the agent store.
- Security research or detection-engineering work that intentionally installs the malicious package in a lab to reproduce the behaviour.