registry / @explorer02/cfm-survey-sdk / 0.8.3

@explorer02/cfm-survey-sdk@0.8.3

A headless React SDK for building survey experiences. Give it a survey instance and it handles fetching, page navigation, answer state, validation, progress, and submission — you keep full control over the markup and styling.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package as a dependency mutates AI-agent instruction/control files in the consuming project. The mutation is automatic, environment-targeted, and defaults to multiple agent ecosystems.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install executes the postinstall lifecycle hook

Impact

Hijacks or materially alters AI-agent instructions for the consumer project without explicit user action.

Mechanism

postinstall writes package-directed AGENTS.md, CLAUDE.md, and .cursorrules files

Policy narrative

On dependency installation, the lifecycle hook identifies the active AI coding environment from process variables and writes or merges package-controlled instructions into project-level `AGENTS.md`, `CLAUDE.md`, and `.cursorrules`. If no environment is identified it defaults to writing all three. The injected files direct agents to read the package's operating contract before coding, creating an unconsented broad AI-agent control-surface mutation.

Rationale

This is a concrete npm postinstall mutation of foreign project AI-agent control files, including a default-all path. No network exfiltration is needed for this behavior to meet the install-control-surface block boundary.

Evidence

package.jsonpostinstall.jspostinstall/detect-agent.jspostinstall/agent-stubs.jstemplates/AGENT.mdAGENTS.mdCLAUDE.md.cursorrules

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `node postinstall.js` on installation.
`postinstall.js` treats dependency installs as consumer installs and targets `INIT_CWD` or the consuming project root.
`postinstall.js` writes/merges `AGENTS.md`, `CLAUDE.md`, and `.cursorrules` without consent.
`postinstall/detect-agent.js` detects Codex, Claude, Cursor, and other agent environments; default target is `all`.
`postinstall/agent-stubs.js` injects instructions pointing agents to package-controlled `templates/AGENT.md`.
`templates/AGENT.md` provides extensive operational instructions for AI coding agents.

Evidence against

The postinstall path shows no network request, credential exfiltration, or shell execution.
The CLI's package installation and subprocess behavior is explicit user-invoked runtime functionality.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 371 KB of source, external domains: custom-p0.feedbook.me, distribution-dashboard-three.vercel.app, nodejs.org, raw.githubusercontent.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-41json

2 "name": "@explorer02/cfm-survey-sdk",

3 "version": "0.8.3",

4 "main": "dist/index.js",

5 "module": "dist/index.mjs",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cfm-sdk": "./dist/cli/index.js"

9 },

10 "files": [

11 "dist",

12 "templates",

13 "postinstall.js",

14 "postinstall"

15 ],

16 "scripts": {

17 "build": "tsup",

18 "build:all": "npm run build",

19 "prepare": "npm run build",

20 "lint": "tsc --noEmit",

21 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "test:coverage": "vitest run --coverage",

25 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

26 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

27 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

28 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

29 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js"

30 },

31 "peerDependencies": {

32 "react": ">=17.0.0",

33 "@tanstack/react-query": "^5.0.0"

34 },

35 "devDependencies": {

36 "@testing-library/jest-dom": "^6.4.2",

37 "@testing-library/react": "^14.2.1",

38 "@testing-library/user-event": "^14.5.2",

39 "@vitest/coverage-v8": "^1.3.1",

40 "@types/react": "^17.0.0",

41 "@tanstack/react-query": "^5.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var Ri=Object.create;var It=Object.defineProperty;var Li=Object.getOwnPropertyDescriptor;var Pi=Object.getOwnPropertyNames;var $i=Object.getPrototypeOf,Di=Object.prototype.hasOwnProperty;var f=(e,t)=>()=>(e&&(t=e(e=0)),t);var ke=(e,t)=>{for(var n in t)It(e,n,{get:t[n],enumerable:!0})},_i=(e,t,n,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of Pi(t))!Di.call(e,i)&&i!==n&&It(e,i,{get:()=>t[i],enumerable:!(o=Li(t,i))||o.enumerable});return e};var y=(e,t,n)=>(n=e!=null?Ri($i(e)):{},_i(t||!e||!e.__esModule?It(n,"default",{value:e,enumerable:!0}):n,e));var c,Ge,w=f(()=>{ ...

3`).length}function wt(e,t,n){let o=new Set;if(t==="fastPath"){let i=e.fastPath;for(let r of i?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(s=>String(s.id)===String(n));if(r)for(let s of Object.keys(r)){if(!s.startsWith("read"))continue;let a=r[s];if(Array.isArray(a))for(let l of a)typeof l=="string"&&o.add(l)}}return[...o]}function ji(e){let t=e.replace(/^\.\.\//,"");return dn[t]??dn[e]}function Et(e,t,n){let o=[];for(let s of t){let a=Fi(e,s);if(!a){o.push({relPath:s,lines:0,tier:"missing"});continue}let l=Qi(a),u=Mi(l),d=u==="slow"||u==="warn"?ji(s.replace(/^\.\.\ ...

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

4${R.bold}Doc read budget audit (${s.profile})${R.reset}`),console.log("\u2500".repeat(40));for(let a of s.entries){let l=a.tier==="ok"?`${R.green}OK ${R.reset}`:a.tier==="warn"?`${R.yellow}WARN${R.reset}`:a.tier==="slow"?`${R.red}SLOW${R.reset}`:`${R.red}MISS${R.reset}`,u=a.hint?` \u2014 ${a.hint}`:"",d=a.tier==="missing"?"missing":`${a.lines} lines`;console.log(`${l} ${a.relPath.padEnd(42)} ${d}${u}`)}if(console.log(`

5${R.dim}Total: ${s.totalLines} lines across ${s.entries.length} paths${R.reset}`),s.slow.length>0){console.log(`

6${R.yellow}A few doc reads are taking longer than expected even from temp files:${R.reset}`);for(let a of s.slow){let l=a.hint?` \u2014 ${a.hint}`:"";console.log(` - ${a.relPath} (${a.lines} lines)${l}`)}}if(e.writeInventory){let a={};for(let l of s.entries)l.tier!=="missing"&&(a[l.relPath]={lines:l.lines,tier:l.tier});o.docInventory={generatedBy:"npx cfm-sdk doc-read-audit --write",caps:{ok:un,warn:fn},profile:s.profile,files:a},G.writeFileSync(fe.join(t,"MANIFEST.json"),`${JSON.stringify(o,null,2)}

7`,"utf8"),console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1

8${R.green}OK:${R.reset} Wrote docInventory to MANIFEST.json`)}return s.ok||e.warnOnly?0:e.ci||s.slow.length>0?1:0}function Lt(e){let t=e??kt(),n=Rt(t),o=wt(n,"fastPath"),i=Et(t,o,"fastPath");return`Doc budget: npx cfm-sdk doc-read-audit \u2014 fast path reads ${i.entries.length} files (~${i.totalLines} lines)`}var G,fe,R,un,fn,dn,Pt=f(()=>{"use strict";G=y(require("fs")),fe=y(require("path"));w();R=c,un=150,fn=250,dn={"MANIFEST.json":"skim MANIFEST.routing.json instead","00-integration/phase-5-6-build-gate.md":"read build-gate/verify-core.md only","00-integration/mockup-to-config-guide.md":"re ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

10I've set everything up on my side. You just need to generate a short code in our distribution dashboard \u2014 then paste it back to me and I'll publish the link.

12| | |

13|---|---|

14| **Your Survey ID** | \`${e}\` |

15| **Open this dashboard** | ${Ge} |

17**What to do:**

181. Open the dashboard link above

192. Click **Create distribution**

203. Paste your **Survey ID** from the table and click **Generate key**

214. Copy the key that appears (a short code like \`a3f91c2e8b4d7016\`)

Long lines were clipped for display.

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs');

13/** Only run when the SDK is installed as a dependency inside node_modules. */

14function isConsumerInstall() {

15 return __dirname.split(path.sep).includes('node_modules');

16}

18/**

19 * @param {string} targetDir

20 * @param {string} filename

21 * @param {string} block

22 */

23function writeMergedStub(targetDir, filename, block) {

24 const filePath = path.join(targetDir, filename);

25 let newContent = block + '\n';

27 if (fs.existsSync(filePath)) {

28 const existing = fs.readFileSync(filePath, 'utf8');

29 newContent = mergeMarkedBlock(existing, block);

30 console.log('Merged SDK stub into ' + filePath);

31 } else {

32 console.log('Created ' + filePath);

33 }

35 fs.writeFileSync(filePath, newContent, 'utf8');

36}

38/**

39 * @param {string} targetDir

40 */

41function writeClaudeMd(targetDir) {

42 const filePath = path.join(targetDir, 'CLAUDE.md');

43 const stub = getClaudeMdStub();

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10511 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var Ri=Object.create;var It=Object.defineProperty;var Li=Object.getOwnPropertyDescriptor;var Pi=Object.getOwnPropertyNames;var $i=Object.getPrototypeOf,Di=Object.proto... L3: `).length}function wt(e,t,n){let o=new Set;if(t==="fastPath"){let i=e.fastPath;for(let r of i?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(s=>String(s.i... L4: ${R.bold}Doc read budget audit (${s.profile})${R.reset}`),console.log("\u2500".repeat(40));for(let a of s.entries){let l=a.tier==="ok"?`${R.green}OK ${R.reset}`:a.tier==="warn"?`$... ... L7: `,"utf8"),console.log(` L8: ${R.green}OK:${R.reset} Wrote docInventory to MANIFEST.json`)}return s.ok||e.warnOnly?0:e.ci||s.slow.length>0?1:0}function Lt(e){let t=e??kt(),n=Rt(t),o=wt(n,"fastPath"),i=Et(t,o,"... L9: ... L74: Source: ${e.source}`),console.log(n),console.log(""),!1}function at(e,t){let n=Rr(t);return n.length?$r({title:"INSTALL SURVEY-TYPE DEPS (run once before Phase 6)",packages:n,proje... L75: `)){let o=n.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<=0)continue;let r=o.slice(0,i).trim(),s=o.slice(i+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.st... L76:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1

postinstall.jsView file

24Install-time AI-agent control hijack evidence: L34: L35: fs.writeFileSync(filePath, newContent, 'utf8'); L36: } ... L41: function writeClaudeMd(targetDir) { L42: const filePath = path.join(targetDir, 'CLAUDE.md'); L43: const stub = getClaudeMdStub(); ... L47: if (!canUpdateClaudeMd(existing)) { L48: console.log('Skipped CLAUDE.md (custom content outside @AGENTS.md bridge)'); L49: return; ... L51: if (existing.trim() === stub.trim()) { L52: console.log('CLAUDE.md already up to date'); L53: return; Payload evidence from postinstall/detect-agent.js: L24: */ L25: function detectAgent(env = process.env) { L26: const override = env.CFM_SDK_AGENT;

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10511 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

Findings

1 Critical5 High5 Medium6 Low

CriticalAi Agent Control Hijackpostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docs/survey-ui/verify-agent-build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 1-41json

2 "name": "@explorer02/cfm-survey-sdk",

3 "version": "0.8.3",

4 "main": "dist/index.js",

5 "module": "dist/index.mjs",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cfm-sdk": "./dist/cli/index.js"

9 },

10 "files": [

11 "dist",

12 "templates",

13 "postinstall.js",

14 "postinstall"

15 ],

16 "scripts": {

17 "build": "tsup",

18 "build:all": "npm run build",

19 "prepare": "npm run build",

20 "lint": "tsc --noEmit",

21 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "vitest run",

23 "test:watch": "vitest",

24 "test:coverage": "vitest run --coverage",

25 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

26 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

27 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

28 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

29 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js"

30 },

31 "peerDependencies": {

32 "react": ">=17.0.0",

33 "@tanstack/react-query": "^5.0.0"

34 },

35 "devDependencies": {

36 "@testing-library/jest-dom": "^6.4.2",

37 "@testing-library/react": "^14.2.1",

38 "@testing-library/user-event": "^14.5.2",

39 "@vitest/coverage-v8": "^1.3.1",

40 "@types/react": "^17.0.0",

41 "@tanstack/react-query": "^5.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

5${R.dim}Total: ${s.totalLines} lines across ${s.entries.length} paths${R.reset}`),s.slow.length>0){console.log(`

7`,"utf8"),console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

10I've set everything up on my side. You just need to generate a short code in our distribution dashboard \u2014 then paste it back to me and I'll publish the link.

12| | |

13|---|---|

14| **Your Survey ID** | \`${e}\` |

15| **Open this dashboard** | ${Ge} |

17**What to do:**

181. Open the dashboard link above

192. Click **Create distribution**

203. Paste your **Survey ID** from the table and click **Generate key**

214. Copy the key that appears (a short code like \`a3f91c2e8b4d7016\`)

Long lines were clipped for display.

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs');

13/** Only run when the SDK is installed as a dependency inside node_modules. */

14function isConsumerInstall() {

15 return __dirname.split(path.sep).includes('node_modules');

16}

18/**

19 * @param {string} targetDir

20 * @param {string} filename

21 * @param {string} block

22 */

23function writeMergedStub(targetDir, filename, block) {

24 const filePath = path.join(targetDir, filename);

25 let newContent = block + '\n';

27 if (fs.existsSync(filePath)) {

28 const existing = fs.readFileSync(filePath, 'utf8');

29 newContent = mergeMarkedBlock(existing, block);

30 console.log('Merged SDK stub into ' + filePath);

31 } else {

32 console.log('Created ' + filePath);

33 }

35 fs.writeFileSync(filePath, newContent, 'utf8');

36}

38/**

39 * @param {string} targetDir

40 */

41function writeClaudeMd(targetDir) {

42 const filePath = path.join(targetDir, 'CLAUDE.md');

43 const stub = getClaudeMdStub();

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10511 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg