registry / AI-agent control-surface risk / @drdeeks/character-kit

@drdeeks/character-kit

Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.

This report shows the evidence for @drdeeks/character-kit@1.2.1. 1 of 9 known versions is blocked or flagged. The newest version, 1.9.1, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The lifecycle hook performs concrete, unprompted Claude configuration mutation and persistence during npm installation. This satisfies the block boundary despite no observed network exfiltration.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install -g @drdeeks/character-kit

Impact

Hijacks a foreign AI-agent control surface and can block or mediate tool calls.

Mechanism

unconsented postinstall hook injection and detached daemon startup

Policy narrative

On global installation, postinstall auto-detects Claude Code and invokes the non-interactive installer. That installer writes a wildcard PreToolUse command into ~/.claude/settings.json, sourcing its environment and calling the package hook for every tool use. It also starts detached daemon, monitor, and watchdog processes. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The lifecycle hook performs concrete, unprompted Claude configuration mutation and persistence during npm installation. This satisfies the block boundary despite no observed network exfiltration.

Evidence

package.jsonnode/bin/postinstall.jsnode/bin/install.jsnode/enforcer/agent_enforcer_daemon.js~/.claude/settings.json~/.agent-character-kit/workspace/.agent/.env~/.agent-character-kit/workspace/.agent/enforcer.sock

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json invokes node/bin/postinstall.js on installation.
node/bin/postinstall.js auto-runs for global node_modules installs without consent.
postinstall detects ~/.claude/settings.json and calls installMain with writeClaudeConfig:true.
node/bin/install.js merges a wildcard PreToolUse command into ~/.claude/settings.json.
The same install path launches detached daemon, monitor, and watchdog processes.

Evidence against

Postinstall is gated to global installs under node_modules.
No external HTTP endpoint or credential exfiltration was found.
Root/systemd deployment requires explicit interactive sudo confirmation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 214 KB of source

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

deploy/ack_watchdog.jsView file

18import { fileURLToPath } from "url"; L19: import { spawn, spawnSync } from "child_process"; L20:

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

node/enforcer/agent_enforcer_daemon.jsView file

51// 1. Check workspace-specific .env (set by install.js per-workspace) L52: const __wsEnv = process.env.AGENT_WORKSPACE && path.join(process.env.AGENT_WORKSPACE, ".agent", ".env"); L53: if (__wsEnv) _loadEnvFile(__wsEnv); ... L58: L59: import net from "net"; L60: import fs from "fs"; ... L62: import path from "path"; L63: import { execSync } from "child_process"; L64: import yaml from "js-yaml";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/enforcer/agent_enforcer_daemon.jsView on unpkg · L51

node/bin/postinstall.jsView file

31* - Auto-detects which harnesses are actually present on this machine L32: * (Claude: ~/.claude/settings.json, Hermes: ~/.hermes/, OpenCode: L33: * ~/.config/opencode/) and wires a companion for each one found, ... L64: const candidates = [ L65: { harness: "claude", marker: path.join(home, ".claude", "settings.json") }, L66: { harness: "hermes", marker: path.join(home, ".hermes") }, ... L80: const write = (line) => { L81: try { fs.appendFileSync(log, line + "\n"); } catch { /* best-effort */ } L82: };

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

node/bin/postinstall.jsView on unpkg · L31

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

node/bin/ack.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @drdeeks/character-kit@1.5.0 matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.5.0 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

deploy/ack_watchdog.jsView file

18import { fileURLToPath } from "url"; L19: import { spawn, spawnSync } from "child_process"; L20:

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

Findings

2 Critical5 High4 Medium3 Low

CriticalSame File Env Network Executionnode/enforcer/agent_enforcer_daemon.js

CriticalAi Agent Control Hijacknode/bin/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdeploy/ack_watchdog.js

HighShell

HighPayload In Excluded Dirpython/tests/python_parity_test.py

HighPrevious Version Dangerous Deltanode/bin/ack.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperpython/tests/python_parity_test.py

MediumStructural Risk Force Deep Review

LowScripts Present

Low

Affected versions and remediation

This report applies to @drdeeks/character-kit@1.2.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @drdeeks/character-kit@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-08 15:20:39.755Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

1.9.1latestClean—AllowPublishedSep 14, 2026, 2:13 AM 1.8.0Clean—AllowPublishedSep 14, 2026, 12:10 AM 1.7.0Clean—AllowPublishedSep 13, 2026, 9:48 PM 1.6.0SuspiciousAI-agent capability abuseWarnPublishedAug 13, 2026, 10:21 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code