registry / @eternalnight/publish-kit / 0.4.0

@eternalnight/publish-kit@0.4.0

Release playbook for AI agents. npm-installable CLI + DSH plugin + skill bundle. Covers npm, GitHub+Gitee dual remote, DSH marketplace, cargo crates.io, PyPI, PyInstaller exe, Go single-binary, Rust single-binary, Electron/Tauri desktop. Bilingual EN/ZH.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies several AI-agent skill roots in the user's home directory. It makes the bundled skill discoverable by multiple unrelated agent products without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, including an install path that runs postinstall.

Impact

The package can inject its bundled instructions into multiple agent control surfaces and replace a prior symlink with the same name.

Mechanism

Postinstall deletion and recreation of agent-skill symlinks.

Policy narrative

During installation, npm runs the package's postinstall program. That program enumerates five agent skill directories under the user's home directory, removes an existing publish-kit symlink where present, creates missing directories, and links the bundled skill into each location. This crosses from package installation into automatic modification of several unrelated AI-agent instruction surfaces, so the install itself can make the package's guidance active in those agents.

Rationale

The source confirms an automatic postinstall hook that mutates broad foreign AI-agent skill roots. Although no exfiltration or downloaded payload is present, this concrete unconsented control-surface mutation meets the install-hook blocking policy.

Evidence

package.jsonscripts/postinstall.js.agents/skills/publish-kit~/.agents/skills/publish-kit~/.claude/skills/publish-kit~/.codex/skills/publish-kit~/.gemini/skills/publish-kit~/.dsh/skills/publish-kit

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs a postinstall program during npm installation.
The installer targets five separate AI-agent skill roots, including Claude, Codex, Gemini, and DSH.
The installer removes any existing symlink of the same name, creates missing root directories, and installs a new symlink in each target.
This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Evidence against

The postinstall source contains no network request, shell execution, credential harvesting, or payload download.
It skips an existing non-symlink directory instead of overwriting it.
The manifest declares no dependencies or runtime self-dependency chain.

Behavioral surface

Source

Filesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.88 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 41-82json

41 "files": [

42 "README.md",

43 "README.zh.md",

44 "LICENSE",

45 "CHANGELOG.md",

46 "scripts/bootstrap-release.ps1",

47 "scripts/bootstrap-release.sh",

48 "scripts/release-exe.ps1",

49 "scripts/release-exe.sh",

50 ".agents/skills/publish-kit/SKILL.md",

51 ".agents/skills/publish-kit/REFERENCE.md",

52 ".agents/skills/publish-kit/TEMPLATE.md",

53 ".agents/skills/publish-kit/INSTALL.md",

54 ".agents/skills/publish-kit/DSH-DEPLOY.md",

55 ".agents/skills/publish-kit/COMPATIBILITY.md",

56 ".agents/skills/publish-kit/EXAMPLES.md",

57 "assets/readme-banner.svg",

58 "cordis.patch.yml",

59 "scripts/postinstall.js"

60 ],

61 "scripts": {

62 "postinstall": "node ./scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 },

High

Suspicious Lifecycle Evidence

The package automatically runs a postinstall program during npm installation.

package.jsonView on unpkg · L61

64 "engines": {

65 "node": ">=18"

66 },

67 "dsh": {

68 "client": {

69 "platform": "web"

70 },

71 "bundle": {

72 "patch": "./cordis.patch.yml"

73 },

74 "marketplace": {

75 "profiles": [

76 "web"

77 ],

78 "requiresBuildApproval": false,

79 "requiresRestart": true,

80 "manualSteps": false

81 }

82 }

scripts/postinstall.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2// postinstall.js - Symlink the bundled skill directory into the user's agent skill roots.

3// Runs once when @eternalnight/publish-kit is installed via `npm install` or `dsh plugin add`.

5const fs = require('fs');

6const path = require('path');

7const os = require('os');

9const PACKAGE_SKILL_SRC = path.join(__dirname, '..', '.agents', 'skills', 'publish-kit');

10const SKILL_NAME = 'publish-kit';

12if (!fs.existsSync(PACKAGE_SKILL_SRC)) {

13 console.warn('[publish-kit] bundled skill directory missing; skipping postinstall symlink');

14 process.exit(0);

15}

17const homes = [

18 path.join(os.homedir(), '.agents', 'skills'),

19 path.join(os.homedir(), '.claude', 'skills'),

20 path.join(os.homedir(), '.codex', 'skills'),

21 path.join(os.homedir(), '.gemini', 'skills'),

22 path.join(os.homedir(), '.dsh', 'skills'),

23];

High

Ai Review Evidence

The installer targets five separate AI-agent skill roots, including Claude, Codex, Gemini, and DSH.

scripts/postinstall.jsView on unpkg · L17

25const linked = [];

26for (const dir of homes) {

27 const dest = path.join(dir, SKILL_NAME);

28 try {

29 if (fs.existsSync(dest)) {

30 const stat = fs.lstatSync(dest);

31 if (stat.isSymbolicLink()) {

32 fs.unlinkSync(dest);

33 } else {

34 // A real directory with the same name exists; skip (don't clobber).

35 console.log('[publish-kit] ' + dest + ' already exists (not a symlink); skipping');

36 continue;

37 }

38 }

39 fs.mkdirSync(dir, { recursive: true });

40 fs.symlinkSync(PACKAGE_SKILL_SRC, dest, 'junction');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L8

High

Ai Review Evidence

The installer removes any existing symlink of the same name, creates missing root directories, and installs a new symlink in each target.

scripts/postinstall.jsView on unpkg · L29

41 linked.push(dest);

42 console.log('[publish-kit] linked ' + dest + ' -> ' + PACKAGE_SKILL_SRC);

43 } catch (err) {

44 console.warn('[publish-kit] failed to link ' + dest + ': ' + err.message);

45 }

46}

48if (linked.length > 0) {

49 console.log('[publish-kit] installed skill bundle in ' + linked.length + ' location(s)');

scripts/release-exe.ps1View file

•path = scripts/release-exe.ps1 kind = build_helper sizeBytes = 7073 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-exe.ps1View on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

61"scripts": { "postinstall": "node ./scripts/postinstall.js" },

High

Suspicious Lifecycle Evidence

The package automatically runs a postinstall program during npm installation.

package.jsonView on unpkg · L61

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

8L9: const PACKAGE_SKILL_SRC = path.join(__dirname, '..', '.agents', 'skills', 'publish-kit'); L10: const SKILL_NAME = 'publish-kit'; ... L17: const homes = [ L18: path.join(os.homedir(), '.agents', 'skills'), L19: path.join(os.homedir(), '.claude', 'skills'), L20: path.join(os.homedir(), '.codex', 'skills'), L21: path.join(os.homedir(), '.gemini', 'skills'), ... L38: } L39: fs.mkdirSync(dir, { recursive: true }); L40: fs.symlinkSync(PACKAGE_SKILL_SRC, dest, 'junction');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L8

17const homes = [ path.join(os.homedir(), '.agents', 'skills'), path.join(os.homedir(), '.claude', 'skills'), path.join(os.homedir(), '.codex', 'skills'), path.join(os.homedir(), '.gemini', 'skills'), path.join(os.homedir(), '.dsh', 'skills'), ];

High

Ai Review Evidence

The installer targets five separate AI-agent skill roots, including Claude, Codex, Gemini, and DSH.

scripts/postinstall.jsView on unpkg · L17

29if (fs.existsSync(dest)) { const stat = fs.lstatSync(dest); if (stat.isSymbolicLink()) { fs.unlinkSync(dest); } else { // A real directory with the same name exists; skip (don't clobber). console.log('[publish-kit] ' + dest + ' already exists (not a symlink); skipping'); continue; } } fs.mkdirSync(dir, { recursive: true }); fs.symlinkSync(PACKAGE_SKILL_SRC, dest, 'junction');

High

Ai Review Evidence

The installer removes any existing symlink of the same name, creates missing root directories, and installs a new symlink in each target.

scripts/postinstall.jsView on unpkg · L29

scripts/release-exe.ps1View file

•path = scripts/release-exe.ps1 kind = build_helper sizeBytes = 7073 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-exe.ps1View on unpkg

Findings

1 Critical4 High3 Medium2 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencescripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helperscripts/release-exe.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem