registry / Destructive action / @deftai/directive-content / 0.119.0

@deftai/directive-content@0.119.0

Shippable Directive framework content in the consumer .deft/core/ layout (C1 flatten), plus the engine surfaces (.githooks/, Taskfile.yml, tasks/) the deposit wires. Python-free per #2022 Phase 3. Refs #11, #1669, #1967.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The automatic postpack hook recursively deletes nearly the entire package directory, creating a concrete destructive action when packing is invoked. This warrants blocking publication as destructive behavior.

Static reason

No blocking static signals were detected.

Trigger

The user runs the package-packing operation, which activates `postpack`.

Impact

Package source and other files in that directory can be irreversibly deleted.

Mechanism

The script enumerates the package directory and recursively force-removes each entry except two named files.

Attack narrative

After packing, the postpack script iterates over the package directory and recursively removes all entries other than `package.json` and `stage-pack.mjs`. This can destroy source files and other directory contents when the package-packing operation is run.

AI rationale

Evidence

package.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The `postpack` script deletes every entry in the package directory except `package.json` and `stage-pack.mjs`, recursively and without prompting.

Evidence against

No install lifecycle hook is declared; the destructive script runs after the user invokes the package-packing operation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 41.4 KB of source

Source & flagged code

3 flagged

.githooks/_deft-run.shView file

•path = .githooks/_deft-run.sh kind = payload_in_excluded_dir sizeBytes = 1873 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.githooks/_deft-run.shView on unpkg

•path = .githooks/_deft-run.sh kind = build_helper sizeBytes = 1873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.githooks/_deft-run.shView on unpkg

package.jsonView file

Lines 3-26json

3 "version": "0.119.0",

4 "deftConsumerDeposit": true,

5 "description": "Shippable Directive framework content in the consumer .deft/core/ layout (C1 flatten), plus the engine surfaces (.githooks/, Taskfile.yml, tasks/) the deposit wires. Python-free per #2022 Phase 3. Refs #11, #1669, #1967.",

6 "license": "MIT",

7 "type": "module",

8 "files": [

9 "**/*",

10 ".githooks/"

11 ],

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/deftai/directive.git",

15 "directory": "packages/content"

16 },

17 "publishConfig": {

18 "access": "public",

19 "provenance": true

20 },

21 "scripts": {

22 "prepack": "node ./stage-pack.mjs",

23 "postpack": "node --input-type=module -e \"import{readdirSync,rmSync}from'node:fs';import{dirname,join}from'node:path';import{fileURLToPath}from'node:url';const pkg=dirname(fileURLToPath(import.meta.url));const keep=new Set(['package.json','stage-pack.mjs']);for(const name of readdirSync(pkg)){if(keep.has(name))continue;rmSync(join(pkg,name),{recursive:true,force:true});}\""

24 }

25}

High

Ai Review Evidence

The `postpack` script deletes every entry in the package directory except `package.json` and `stage-pack.mjs`, recursively and without prompting.

package.jsonView on unpkg · L23

Source & flagged code

3 flagged · loading source

.githooks/_deft-run.shView file

•path = .githooks/_deft-run.sh kind = payload_in_excluded_dir sizeBytes = 1873 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.githooks/_deft-run.shView on unpkg

•path = .githooks/_deft-run.sh kind = build_helper sizeBytes = 1873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.githooks/_deft-run.shView on unpkg

package.jsonView file

23"postpack": "node --input-type=module -e \"import{readdirSync,rmSync}from'node:fs';import{dirname,join}from'node:path';import{fileURLToPath}from'node:url';const pkg=dirname(fileURLToPath(import.meta.url));const keep=new Set(['package.json','stage-pack.mjs']);for(const name of readdirSync(pkg)){if(keep.has(name))continue;rmSync(join(pkg,name),{recursive:true,force:true});}\"" } }

Findings

2 High3 Medium3 Low

HighPayload In Excluded Dir.githooks/_deft-run.sh

HighAi Review Evidencepackage.json

MediumEnvironment Vars

MediumShips Build Helper.githooks/_deft-run.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @deftai/directive-content@0.119.0.

See all versions of @deftai/directive-content for other recorded verdicts.

Avoid installing @deftai/directive-content@0.119.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-08 15:48:25.076Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other destructive action packages

Behavioral surface

Related packages

Other destructive action packages

Source & flagged code