registry / @bfrs/agentic-components / 0.7.0

@bfrs/agentic-components@0.7.0

Shiprocket agentic component library and documentation showcase.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates a consuming project's AI-agent instruction files and build scripts. This is a broad foreign control-surface change without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes postinstall

Impact

Influences AI coding agents and can make consumer builds fail unless package rules are followed.

Mechanism

Copies agent guidance and injects a mandatory lint guard into consumer build scripts

Policy narrative

On npm postinstall, the package identifies the consumer project, copies its agent context document there, creates or appends consumer AGENTS.md/CLAUDE.md, and rewrites package.json to inject bfrs-agentic-lint before build scripts. The lint enforces use of this package's components and styling conventions. These unconsented install-time changes target a foreign project and AI-agent control surface.

Rationale

Source inspection confirms an unconsented postinstall mutation of consumer AI-agent instruction files and build controls. Although no exfiltration or remote execution was found, this meets the install-control-surface block policy.

Evidence

package.jsonscripts/postinstall.cjsscripts/lint/cli.cjsBFRS_AGENTIC_COMPONENTS.mdAGENTS.mdCLAUDE.md

Decision evidence

public snapshot

@bfrs/agentic-components@0.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code