@bfrs/agentic-components@0.8.1
Shiprocket agentic component library and documentation showcase.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest activates a consumer-project postinstall hook that writes to agent instruction files and modifies build scripts without affirmative consent. This is an unconsented install-time mutation of an AI-agent control surface, supporting a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package as a dependency runs its postinstall hook; setup proceeds unless an opt-out variable is set.
Impact
AI coding agents may load package-supplied instructions, and consumer builds may be changed to run the package’s lint command.
Mechanism
The hook copies package context into the consumer project, adds references in agent instruction files, and adds or modifies build scripts to run the package lint command.
Policy narrative
During dependency installation, the postinstall hook edits the consumer project’s agent instruction files and build scripts. The package-aligned context and lint purpose explain the functionality, but setup is automatic and protected only by an opt-out; it therefore creates an unconsented agent control surface.
AI rationale
The manifest activates a consumer-project postinstall hook that writes to agent instruction files and modifies build scripts without affirmative consent. This is an unconsented install-time mutation of an AI-agent control surface, supporting a block.
Evidence
package.jsonscripts/postinstall.cjsAGENTS.mdCLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.
Evidence for policy risk
- The package manifest runs scripts/postinstall.cjs during postinstall.
- The hook runs for consumer installs and only skips setup when an environment variable is set.
- The hook targets AGENTS.md and CLAUDE.md, adding a reference to package-provided context files.
- The hook copies that context into the consumer project and invokes the agent-file and package-script mutations.
- The hook adds a lint command and prepends it to selected consumer build scripts.
Evidence against
- The copied context describes component-library guidance and a related lint guard, consistent with the package’s stated purpose.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg54"scripts": {
"postinstall": "node scripts/postinstall.cjs",
"dev": "vite --host 0.0.0.0",
High
Suspicious Lifecycle Evidence
The package manifest runs scripts/postinstall.cjs during postinstall.
package.jsonView on unpkg · L54•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.cjsView file
Findings
1 Critical4 High3 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/fonts.css
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/postinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @bfrs/agentic-components@0.8.1.
See all versions of @bfrs/agentic-components for other recorded verdicts.
- Avoid installing @bfrs/agentic-components@0.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.