registry / AI-agent control-surface risk / @deppon/pm-toolkit
@deppon/pm-toolkit
德邦 PRD 产品经理工具包脚手架：create 开箱工作台；init/update 同步工具
This report shows the evidence for @deppon/pm-toolkit@2.5.105. 6 of 11 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, including a remote latest npx MCP command. The guard against global installs does not limit the behavior for ordinary consumer-project installation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install of the package as a project dependency.
Impact
Consumer AI-agent clients may load package-provided instructions and execute the configured npx latest MCP command; project files are modified during installation.
Mechanism
Postinstall invokes a broad project synchronizer that writes agent files, MCP settings, scripts, and copied assets.
Policy narrative
The postinstall hook detects a normal project dependency installation and immediately calls the installer with all AI-agent platforms and agent features enabled. The installer populates JoyCode, Cursor, and WorkBuddy directories, registers MCP entries, and configures one entry as `npx -y @playwright/mcp@latest`. It also changes the consumer package.json and copies executable tooling. These broad, unconsented install-time modifications affect foreign AI-agent control surfaces and can cause later agent startup to fetch and run a moving external package.
AI rationale
This is concrete unconsented postinstall mutation of multiple foreign AI-agent control surfaces, including a remote latest npx MCP command. The guard against global installs does not limit the behavior for ordinary consumer-project installation.
Evidence
package.jsonbin/postinstall.jslib/install.js.joycode/mcp.json.cursor/mcp.json.workbuddy/mcp.json.joycode/agent.jsonscripts/proto-version.jsmcp/proto-version-server.js
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package declares an automatic postinstall hook.
- Postinstall runs the installer against the consuming project with JoyCode, Cursor, WorkBuddy, agent, and version features all enabled.
- The installer writes MCP registrations into three AI-agent configuration directories and adds an npx command pinned to latest.
- The installer overwrites the consumer package.json scripts and adds itself as a development dependency.
Evidence against
- The postinstall hook skips global or npx-style installs unless this package is installed under the consumer project node_modules.
- The inspected MCP servers are local stdio tools for prototype versioning and local code search; no credential collection or secret exfiltration was found.
- The flagged Python test file is an ordinary unittest suite, not a hidden payload.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/install.jsView file
1Install-time code directly mutates a foreign AI-agent control surface:
L721: if (changed && !DRY) {
L722: fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf8')
L723: }
...
L992: if (DRY) return
L993: fs.mkdirSync(dir, { recursive: true })
L994: }
...
L1001: fs.rmSync(to, { recursive: true, force: true })
L1002: fs.cpSync(from, to, {
L1003: recursive: true,
...
L1023: if (!text.endsWith('\r\n')) text += '\r\n'
L1024: fs.writeFileSync(to, text, 'utf8')
L1025: return
Write operation from lib/install.js:
L721: if (changed && !DRY) {
L722: fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf8')
L723: }
...
L992: if (DRY) return
L993: fs.mkdirSync(dir, { recursive: true })
L994: }
...
L1001: fs.rmSync(to, { recursive: true, force: true })
L1002: fs.cpSync(from, to
Findings
1 Critical6 High5 Medium4 Low
CriticalAi Agent Control Hijacklib/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/install.js
HighSame File Env Network Executionassets/scripts/proto-version.js
HighRuntime Package Installlib/install.js
HighPayload In Excluded Dirassets/skills/ui-ux-pro-max/scripts/tests/test_core.py
HighSemantic Analysis Limitedlib/migrate-shell.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperassets/scripts/PM-Start-Version-Service.bat
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @deppon/pm-toolkit@2.5.105.
The versions list below shows the verdict for each recorded version.
- Avoid installing @deppon/pm-toolkit@2.5.105. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
11 known versions2.5.105latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 11, 2026, 4:48 PM2.5.102MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 1, 2026, 5:52 AM2.5.101MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 4:26 PM2.5.100MaliciousInstall Hook AbuseBlockPublished