# Package Lifecycle Script Writes Agent Memory/Instruction Store

- **Severity:** High
- **Signature ID:** `7c3f1d2a-9b64-4e18-a5d7-2f0c6b81e4a3`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain), LLM04 (Data and Model Poisoning)

## Summary

Installing a package with npm, pnpm, yarn or bun can trigger a hidden setup step that drops files into an AI agent's memory or instruction folders, such as ~/.claude/skills or ~/.codex. Because agents re-read those folders on every future run, this gives an attacker a way to plant standing instructions the agent will later follow, all through a routine package install.

## How the attack works

A developer or CI job runs a normal package install command (npm install, yarn, pnpm, bun, or npx). A lifecycle script bundled with that package - or a binary shipped inside node_modules - runs automatically as part of the install and spawns further processes. One of those processes writes files into an AI agent's memory, instruction, or skills directory (paths like ~/.claude/skills, ~/.codex, ~/.gemini, or .mcp.json), sometimes registering a new named capability. The agent later reads those files as instructions on every subsequent invocation, so the attacker gets persistent influence over the agent's behavior without ever touching it directly.

## Why it matters

An attacker can use a compromised or malicious npm/pnpm/yarn/bun package to plant instructions that an AI agent will silently obey from then on, effectively hijacking agent behavior through a supply-chain foothold rather than a one-time exploit.

## What you can do

- Review what postinstall/lifecycle scripts your dependencies run before installing them, and pin or vet packages that touch agent memory, skill, or MCP config directories.
- Treat any new files appearing in agent memory/instruction/skill folders (~/.claude, ~/.codex, ~/.gemini, *.mcp.json) right after a package install as suspicious until confirmed to be part of an intentional plugin setup.
- Restrict write access to agent memory/instruction directories so only explicit, user-approved setup steps can modify them.
- When triaging an alert, check the package name and install command in the lineage to confirm whether the write was part of a known, approved agent plugin's documented install step.

## Known benign look-alikes

- Legitimate, user-approved agent plugin packages installed from npm that intentionally write skills or prompt files into ~/.claude/skills, ~/.codex or ~/.gemini as part of their documented setup step. These will be reported once per install burst; triage by confirming the package name in the Supply-Chain Delivery stage command line.
- An MCP server package whose postinstall step writes or patches a .mcp.json / mcp_settings.json entry during a deliberate developer install.
- A monorepo bootstrap (pnpm install / yarn install) that runs a workspace prepare script which copies documentation markdown into a shared user data directory whose path happens to contain a memory/prompt/skill token.
- Reinstall or upgrade of an already-trusted agent toolkit, which repeats the same fan-out of markdown files into the agent store.
- Security research or detection-engineering work that intentionally installs the malicious package in a lab to reproduce the behaviour.

## References

- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://atlas.mitre.org/techniques/AML.T0010
- https://attack.mitre.org/techniques/T1195/002/

---
Source: https://www.netzilo.com/threats/npm-lifecycle-agent-memory-store-injection