@bfrs/agentic-components@0.7.8
Shiprocket agentic component library and documentation showcase.
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource confirms an automatic postinstall mutation of consumer AI agent instruction files, with only an opt-out guard. Under the control-surface policy, this warrants blocking as an AI agent control hijack; the source does not establish credential theft or network activity.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm, unless the setup skip variable is set to 1.
Impact
The package changes context available to AI agents in the consuming project without an affirmative setup step.
Mechanism
The hook creates or appends a reference in AGENTS.md or CLAUDE.md and copies the referenced context file into the project.
Policy narrative
During npm postinstall, the package edits project-root agent instruction files and points them to package-provided context. The source includes an opt-out, but the lifecycle hook performs the changes without affirmative consent. This is an install-time mutation of a broad agent control surface.
AI rationale
Source confirms an automatic postinstall mutation of consumer AI agent instruction files, with only an opt-out guard. Under the control-surface policy, this warrants blocking as an AI agent control hijack; the source does not establish credential theft or network activity.
Evidence
package.jsonscripts/postinstall.cjsAGENTS.mdagents.mdCLAUDE.mdclaude.mdBFRS_AGENTIC_COMPONENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs a postinstall script during package installation.
- The script acts in a consumer install unless its setup skip variable is set to 1.
- The script targets project-root AGENTS.md or agents.md and CLAUDE.md or claude.md files.
- It creates or appends a reference to the package’s agent context in those files, and invokes this mutation during postinstall.
- The hook also copies its context file into the project and can modify the consumer package scripts.
Evidence against
- The package documents this setup and provides an opt-out variable, but neither is an affirmative consent guard for the agent-file changes.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg54"scripts": {
"postinstall": "node scripts/postinstall.cjs",
"dev": "vite --host 0.0.0.0",
"build
High
Suspicious Lifecycle Evidence
The manifest runs a postinstall script during package installation.
package.jsonView on unpkg · L54•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.cjsView file
Findings
1 Critical4 High3 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/fonts.css
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/postinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bfrs/agentic-components@0.7.8.
See all versions of @bfrs/agentic-components for other recorded verdicts.
- Avoid installing @bfrs/agentic-components@0.7.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.