registry / AI-agent control-surface risk / @buntok/core
@buntok/core
Core HTTP framework for Bun — Express-like, bring your own structure
This report shows the evidence for @buntok/core@1.0.9. 4 of 25 known versions are blocked or flagged. The newest version, 2.2.4, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms an automatic postinstall writes both a project-root file and a package-controlled AI-agent skill outside the package. This is concrete, unconsented install-time mutation of a foreign control surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation
Impact
Unconsented modification of a foreign project and its agent control surface.
Mechanism
postinstall project and AI-agent configuration mutation
Policy narrative
The package declares a postinstall hook, so installing it executes code in the caller's project context. That code derives the project root from INIT_CWD or cwd, overwrites its README.md, creates .agents/skills/buntok, and writes a package-supplied SKILL.md there. It then tells the user to restart the agent so the injected skill loads. No exfiltration was found, but the unconsented install-time foreign AI-agent control-surface mutation meets the block policy.
AI rationale
Source inspection confirms an automatic postinstall writes both a project-root file and a package-controlled AI-agent skill outside the package. This is concrete, unconsented install-time mutation of a foreign control surface.
Evidence
package.jsonscripts/postinstall.mjsscripts/buntok-skill/SKILL.mdREADME.md.agents/skills/buntok/SKILL.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.mjs automatically on installation.
- Postinstall selects the invoking project root via INIT_CWD or cwd.
- It overwrites the project-root README.md.
- It creates and writes .agents/skills/buntok/SKILL.md, then instructs restart to load it.
Evidence against
- The copied SKILL.md is framework documentation; inspected content contains no prompt-hijack instructions.
- Postinstall contains no network, shell, credential-harvesting, or payload-execution logic.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/core-exports.cjsView file
190module.exports = __toCommonJS(core_exports_exports);
L191: var import_zod3 = require("zod");
L192:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core-exports.cjsView on unpkg · L190Findings
1 Critical3 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.mjs
HighKnown Malware Source Similaritydist/cli/index.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/core-exports.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/core-exports.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @buntok/core@1.0.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing @buntok/core@1.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.