registry / AI-agent control-surface risk / @adammcarter/use-cases
@adammcarter/use-cases
**Keep your AI agent's "it works" honest.**
This report shows the evidence for @adammcarter/use-cases@0.5.0. 3 of 7 known versions are blocked or flagged. The newest version, 0.5.3, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concrete unconsented postinstall persistence chain across foreign AI-agent configurations. No exfiltration was found, but the lifecycle control-surface mutation meets the blocking policy.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm global install of the package, unless disabled by environment variables.
Impact
Persistent package-controlled instructions execute across Claude, Codex, OpenCode, and Copilot sessions.
Mechanism
postinstall agent-hook registration and session prompt injection
Policy narrative
The postinstall runs on every global install by default and writes user-level configuration for four unrelated AI-agent hosts. Those registrations invoke the package hook or plugin in future sessions, injecting package-controlled bootstrap text. This is a persistent, broad AI-agent control-surface mutation without an explicit setup command.
AI rationale
Source inspection confirms a concrete unconsented postinstall persistence chain across foreign AI-agent configurations. No exfiltration was found, but the lifecycle control-surface mutation meets the blocking policy.
Evidence
package.jsonscripts/install-agent-hooks.mjshooks/session-startbootstrap/use-cases.md.opencode/plugin/use-cases.js~/.claude/settings.json~/.codex/hooks.json~/.config/opencode/opencode.json~/.copilot/hooks/use-cases.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- scripts/install-agent-hooks.mjs activates on global installs without affirmative opt-in.
- It writes Claude, Codex, OpenCode, and Copilot user agent configuration.
- hooks/session-start injects bootstrap/use-cases.md into future agent sessions.
Evidence against
- Injected bootstrap is local package text; no network or credential exfiltration found.
- MCP dynamic import only falls back to bundled local core.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-agent-hooks.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackages/mcp/dist/index.jsView file
11try {
L12: return await import("@adammcarter/use-cases-core");
L13: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
packages/mcp/dist/index.jsView on unpkg · L11scripts/install-agent-hooks.mjsView file
1Install-time AI-agent control hijack evidence:
L2: import { spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
L4: import { homedir } from "node:os";
...
L42: function writeJson(path, value) {
L43: mkdirSync(dirname(path), { recursive: true });
L44: writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
L45: }
...
L116: const config = readJson(path, { $schema: "https://opencode.ai/config.json" });
L117: const pluginPath = resolve(packageRoot, ".opencode/plugin/use-cases.js");
L118: const plugins = (Array.isArray(config.plugin) ? config.plugin : []).filter((entry) => {
L119: const value = Array.isArray(entry) ? entry[0] : entry;
L120: return typeof value !== "string" || !value.endsWith("/.opencode/plugin/use-
Findings
1 Critical5 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install-agent-hooks.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Direxamples/python-pytest/tests/use_cases/example.checkout.apply_coupon_test.py
HighKnown Malware Source Similarityscripts/install-agent-hooks.mjs
HighKnown Malware Source Similaritypackages/core/dist/schema/registry.js
HighPrevious Version Dangerous Deltapackages/core/dist/markers/cli/verify.js
MediumDynamic Requirepackages/mcp/dist/index.js
MediumEnvironment Vars
MediumShips Build Helperexamples/python-pytest/tests/use_cases/example.checkout.apply_coupon_test.py
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @adammcarter/use-cases@0.5.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @adammcarter/use-cases@0.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions0.5.3latestSuspiciousAgent extension lifecycle riskWarnPublishedJul 23, 2026, 9:25 AM0.5.2SuspiciousAgent extension lifecycle riskWarnPublishedJul 23, 2026, 1:46 AM0.5.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 22, 2026, 1:32 AM0.4.3MaliciousSoft block: AI-agent control surfaceBlockPublished