registry / @ensi-platform/admin-ui / 0.10.0

@ensi-platform/admin-ui@0.10.0

Admin UI for Ensi admin panel

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The automatic postinstall changes agent configuration across three ecosystems and can replace a same-named skill without a separate setup action. The inspected skill is package-aligned UI guidance, so this is an agent extension lifecycle risk rather than a confirmed attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Package installation runs the postinstall hook while the consumer path belongs to a Git repository.

Impact

Agents may receive package-provided instructions without a separate setup action, and a user's existing same-named skill may be replaced. The inspected behavior establishes an agent extension lifecycle risk, not a confirmed attack.

Mechanism

The CLI defaults to all three supported agent targets, copies the package skill after removing any existing same-named destination, and updates `AGENTS.md` for Codex.

AI rationale

Evidence

package.jsonbin/ai.jsai/skills/admin-ui/SKILL.md.cursor/skills/admin-ui.claude/skills/admin-ui.agents/skills/admin-uiAGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs `node ./bin/ai.js` from its postinstall hook.
The CLI targets skill directories for Cursor, Claude, and Codex; with no target flags, it selects all three.
The CLI uses the consumer's current directory to find a Git root, then copies the package skill into the selected agent directories.
Copying removes an existing same-named skill directory first; the Codex target also causes the CLI to update the repository's `AGENTS.md`.
The installed skill contains admin UI component guidance.

Evidence against

Searches of `bin/ai.js` found no `fetch(` or `child_process` references.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 188 file(s), 879 KB of source, external domains: www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 258-280json

258 "types": "./dist/tokens/index.d.ts",

259 "import": "./dist/tokens/index.js"

260 },

261 "./tooltip": {

262 "types": "./dist/tooltip/index.d.ts",

263 "import": "./dist/tooltip/index.js"

264 },

265 "./typography": {

266 "types": "./dist/typography/index.d.ts",

267 "import": "./dist/typography/index.js"

268 },

269 "./vertical-tabs": {

270 "types": "./dist/vertical-tabs/index.d.ts",

271 "import": "./dist/vertical-tabs/index.js"

272 }

273 },

274 "bin": {

275 "admin-ui:ai": "./bin/ai.js"

276 },

277 "scripts": {

278 "postinstall": "node ./bin/ai.js || exit 0"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L278

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L278

279 }

280}

bin/ai.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import { formatWithOptions, parseArgs as parseArgs$1 } from 'util';

3import g, { stdin, stdout } from 'process';

4import f from 'readline';

5import

dist/assets/Component.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/assets/Component.cssView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/ai.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/ai.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/ai.jsView file

8import { join, sep, resolve, dirname } from 'path'; L9: import { existsSync, readFileSync, readdirSync, rmSync, mkdirSync, cpSync, writeFileSync } from 'fs'; L10: ... L8525: cursor: join(".cursor", "skills"), L8526: claude: join(".claude", "skills"), L8527: codex: join(".agents", "skills") L8528: }; ... L8531: var resolveTargets = (flags) => { L8532: const selected = [flags.cursor ? "cursor" : "", flags.claude ? "claude" : "", flags.codex ? "codex" : ""].filter( L8533: (target) => isExportTarget(target) ... L8606: } L8607: writeFileSync(targetPath, content);

Findings

1 Critical5 High3 Medium5 Low

CriticalAi Agent Control Hijackbin/ai.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/ai.js

HighSemantic Analysis Limiteddist/assets/Component.css

HighKnown Malware Source Similaritybin/ai.js

HighKnown Malware Source Fingerprint Signaturebin/ai.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Low

Affected versions and remediation

This report applies to @ensi-platform/admin-ui@0.10.0.

See all versions of @ensi-platform/admin-ui for other recorded verdicts.

Review the evidence and your use of @ensi-platform/admin-ui@0.10.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-17 08:31:34.623Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.