registry / Install hook abuse / @deftai/directive-content / 0.105.0

@deftai/directive-content@0.105.0

Shippable Directive framework content in the consumer .deft/core/ layout (C1 flatten), plus the engine surfaces (.githooks/, Taskfile.yml, tasks/) the deposit wires. Python-free per #2022 Phase 3. Refs #11, #1669, #1967.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an explicit, project-local hook setup rather than unconsented install-time mutation. It merits a warning for its persistent command-execution surface, not a block.

Static reason

No blocking static signals were detected.

Trigger

User runs `task setup`, then performs a Git commit or push.

Impact

Commit and push workflows invoke the configured `deft` verification commands.

Mechanism

Explicit project-local Git hook configuration

AI rationale

This is an explicit, project-local hook setup rather than unconsented install-time mutation. It merits a warning for its persistent command-execution surface, not a block.

Evidence

package.jsonTaskfile.yml.githooks/pre-commit.githooks/pre-push.githooks/_deft-run.sh.git/config

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`task setup` changes the current project's Git hooks path.
Bundled hooks invoke the `deft` CLI on commits and pushes.

Evidence against

No npm preinstall/install/postinstall lifecycle hook is declared.
Only three shell files are executable; no payload binary or symlink was found.
Reviewed hook code contains no network, credential harvesting, or exfiltration logic.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 40.2 KB of source

Source & flagged code

4 flagged

.githooks/_deft-run.shView file

•path = .githooks/_deft-run.sh kind = payload_in_excluded_dir sizeBytes = 1873 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.githooks/_deft-run.shView on unpkg

•path = .githooks/_deft-run.sh kind = build_helper sizeBytes = 1873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.githooks/_deft-run.shView on unpkg

Taskfile.ymlView file

Lines 617-657yaml

617 env:

618 PYTHONUTF8: "1"

619 cmds:

620 # Inline POSIX-sh under go-task's mvdan/sh interpreter -- cross-platform.

621 # `git config core.hooksPath .githooks` is itself idempotent, but we

622 # detect the no-op so the task prints a friendly message rather than

623 # silently re-asserting on every invocation.

624 - |

625 missing=0

626 for f in pre-commit pre-push _deft-run.sh; do

627 if [ ! -f ".githooks/$f" ]; then

628 missing=1

629 break

630 fi

631 done

632 if [ "$missing" = 1 ]; then

633 echo "❌ deft setup refused: project-root .githooks/ is missing hook files (#2530)."

634 echo " Recovery: run \`deft update\` (or \`deft init\` on a greenfield tree) to deposit hooks first."

635 exit 1

636 fi

637 configured=$(git config --get core.hooksPath || true)

638 if [ "$configured" = ".githooks" ]; then

639 echo "✓ core.hooksPath already set to .githooks (no change)."

640 else

641 git config core.hooksPath .githooks

642 echo "✓ core.hooksPath set to .githooks (#747 branch gate active)."

Medium

Ai Review Evidence

`task setup` changes the current project's Git hooks path.

Taskfile.ymlView on unpkg · L637

643 fi

644 # #814: Detect a Python interpreter whose stdout defaults to a

645 # non-UTF-8 Windows code page (cp1252 / cp437). Informational only --

646 # the deft hook scripts themselves self-reconfigure to UTF-8 at

647 # main() entry, so this warning surfaces a fact about the user's

648 # environment, not a defect that blocks setup. We do NOT auto-set

649 # PYTHONIOENCODING because mutating the user's environment would

650 # surprise other tooling (out-of-scope per the issue body).

651 - |

652 python_bin="${DEFT_PYTHON:-}"

653 if [ -z "$python_bin" ]; then

654 if command -v python3 >/dev/null 2>&1; then

655 python_bin=python3

656 elif command -v python >/dev/null 2>&1; then

657 python_bin=python

.githooks/pre-commitView file

Lines 1-26text

1#!/usr/bin/env sh

2# .githooks/pre-commit -- deft CLI gates (#2049 / #747 / #798 / #1620).

4# Activated by `git config core.hooksPath .githooks` via `task setup` or the

5# deft installer (#1463). Pure POSIX shell; prefers global `deft` on PATH,

6# falls back to local packages/cli/dist/bin.js in the maintainer monorepo (#2067).

8REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"

9if [ -z "$REPO_ROOT" ]; then

10 echo "deft pre-commit: unable to resolve repo root via 'git rev-parse'." >&2

11 exit 1

12fi

Source & flagged code

4 flagged · loading source

.githooks/_deft-run.shView file

•path = .githooks/_deft-run.sh kind = payload_in_excluded_dir sizeBytes = 1873 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.githooks/_deft-run.shView on unpkg

•path = .githooks/_deft-run.sh kind = build_helper sizeBytes = 1873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.githooks/_deft-run.shView on unpkg

Taskfile.ymlView file

637configured=$(git config --get core.hooksPath || true) if [ "$configured" = ".githooks" ]; then echo "✓ core.hooksPath already set to .githooks (no change)." else git config core.hooksPath .githooks echo "✓ core.hooksPath set to .githooks (#747 branch gate active)."

Medium

Findings

1 High5 Medium3 Low

HighPayload In Excluded Dir.githooks/_deft-run.sh

MediumEnvironment Vars

MediumShips Build Helper.githooks/_deft-run.sh

MediumStructural Risk Force Deep Review

MediumAi Review EvidenceTaskfile.yml

MediumAi Review Evidence.githooks/pre-commit

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @deftai/directive-content@0.105.0.

See all versions of @deftai/directive-content for other recorded verdicts.

Review the evidence and your use of @deftai/directive-content@0.105.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 04:02:00.920Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.