@cakejp/design-system@0.17.1: Manual Review npm security report | LPM Firewall

Loading npm security reports…

@cakejp/design-system@0.17.1: Manual Review npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/init.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/init.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/init.jsView file

5// AI エージェントは node_modules 配下のファイルを自動で読まないため、 L6: // プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS 利用ガイドを L7: // 参照する薄いポインタ）を置く必要がある。 ... L9: // Usage: L10: // npx cakejp-ds init # AGENTS.md + CLAUDE.md を設置 L11: // npx cakejp-ds init --force # 既存ファイルを上書き ... L13: L14: import { copyFileSync, existsSync, readdirSync } from "node:fs" L15: import { dirname, join, resolve } from "node:path" ... L113: const files = [ L114: { src: "templates/AGENTS.md", dest: "AGENTS.md", label: "Codex 用" }, L115: { src: "templates/CLAUDE.md", dest: "CLAUDE.md", label: "Claude Code 用" },

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/init.jsView on unpkg · L5

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: .slice(1)] await import(join(pkgroot, "scripts/codemod/check-migration.mjs")) process.exit(0) } if (cmd === "check-duplicates") { process.argv = [process.argv[0], process.argv[1], ...args.slice(1)] await import(join(pkgroot, "bin/check-duplicates.mjs")) process.exit(0) } if (cmd !== "init" && cmd !== "postinstall") { console.error(`未知のコマンド: ${cmd}`) console.error(`npx cakejp-ds help を参照してください`) process.exit(1) }

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/init.jsView on unpkg

71process.argv = [process.argv[0], process.argv[1], ...args.slice(2)] L72: await import(join(pkgRoot, "scripts/codemod", `${subcmd}.mjs`)) L73: process.exit(0)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/init.jsView on unpkg · L71

Source & flagged code

5 flagged

package.jsonView file

Lines 66-106json

66 "default": "./dist/index.css"

67 },

68 "./preset": "./src/preset.css",

69 "./preset-standalone": "./src/preset-standalone.css",

70 "./styles": "./src/preset.css",

71 "./tokens/primitive": "./src/styles/primitive.css",

72 "./tokens/semantic": "./src/styles/semantic.css",

73 "./tokens/typography": "./src/styles/typography.css",

74 "./tokens/motion": "./src/styles/motion.css",

75 "./eslint/deprecated": "./eslint/deprecated.js"

76 },

77 "sideEffects": [

78 "*.css"

79 ],

80 "scripts": {

81 "dev": "vite",

82 "build": "tsc -b && vite build",

83 "build:lib": "vite build --config vite.config.lib.ts && node scripts/append-tailwind-source-manifest.mjs && tsc --project tsconfig.lib.json && tsc-alias --project tsconfig.lib.json",

84 "prepack": "npm run build:lib",

85 "prepare": "npm run build:lib",

86 "postinstall": "node ./bin/init.js postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L86

87 "lint": "eslint .",

88 "preview": "vite preview",

89 "storybook": "storybook dev -p 6006",

90 "build-storybook": "storybook build",

91 "lint:scratch": "bash scripts/lint-scratch.sh",

92 "lint:reuse": "bash scripts/check-story-reuse.sh",

93 "lint:border": "node scripts/check-border-color.mjs",

94 "lint:docs": "bash scripts/check-docs-drift.sh",

95 "typecheck:stories": "tsc --noEmit -p tsconfig.stories.json",

96 "generate:lint-rules": "node scripts/generate-lint-rules.mjs",

97 "generate:lookup": "node scripts/generate-component-lookup.mjs",

98 "lint:contrast": "node scripts/check-contrast.mjs",

99 "check": "tsc --noEmit -p tsconfig.app.json && npm run typecheck:stories && bash scripts/check-deps.sh && bash scripts/check-drift.sh && bash scripts/check-docs-drift.sh && bash scripts/lint-scratch.sh && bash scripts/check-story-reuse.sh && bash scripts/check-responsive.sh && node scripts/check-border-color.mjs && npm run lint:contrast && bash scripts/lint-scratch.sh --components && bash scripts/check-generated-drift.sh",

100 "test": "vitest run --config vitest.config.ts",

101 "test:interaction": "vitest run --config vitest.storybook.config.ts",

102 "test:a11y": "vitest run --config vitest.a11y.config.ts"

103 },

104 "dependencies": {

105 "class-variance-authority": "^0.7.1",

106 "clsx": "^2.1.1",

bin/init.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3// @cakejp/design-system init

4// Consumer プロジェクトに AI (Claude / Codex) 向けルールファイルを設置する。

5// AI エージェントは node_modules 配下のファイルを自動で読まないため、

6// プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS 利用ガイドを

7// 参照する薄いポインタ）を置く必要がある。

8//

9// Usage:

10// npx cakejp-ds init # AGENTS.md + CLAUDE.md を設置

11// npx cakejp-ds init --force # 既存ファイルを上書き