registry  /  @explorer02/cfm-survey-sdk  /  0.8.7

@explorer02/cfm-survey-sdk@0.8.7

A headless React SDK for building survey experiences. Give it a survey instance and it handles fetching, page navigation, answer state, validation, progress, and submission — you keep full control over the markup and styling.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code modifies AI coding-agent instruction/control files in the consuming project. It targets `INIT_CWD` or a parent of the installed package and defaults to writing all supported agent stubs without user consent.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm dependency installation invoking `postinstall`
Impact
Changes project-level agent instructions and can steer Codex, Claude Code, or Cursor behavior after installation.
Mechanism
environment-detected or default AI-agent control-file injection
Policy narrative
On consumer installation, the postinstall script selects the consuming project directory from `INIT_CWD` or a parent path. It fingerprints coding-agent environment variables and, absent any signal, defaults to `all`; it then creates or merges package-authored instructions into project `AGENTS.md`, `CLAUDE.md`, and `.cursorrules`. This is unconsented install-time mutation of a broad foreign AI-agent control surface.
Rationale
The lifecycle script creates or alters project-level AI-agent instruction files by default, satisfying the concrete install-time control-hijack boundary. Other observed network and CLI execution are not needed for the verdict.
Evidence
package.jsonpostinstall.jspostinstall/detect-agent.jspostinstall/agent-stubs.jstemplates/AGENT.md<consumer-project>/AGENTS.md<consumer-project>/CLAUDE.md<consumer-project>/.cursorrules

Decision evidence

public snapshot
AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for policy block
  • `package.json` runs `node postinstall.js` on install.
  • `postinstall.js` treats `INIT_CWD` as target project root.
  • `postinstall.js` unconditionally detects AI-agent environments during consumer installs.
  • `postinstall.js` writes project `AGENTS.md`, `CLAUDE.md`, or `.cursorrules`.
  • `postinstall/detect-agent.js` defaults to `all` when no agent signal exists.
  • `postinstall/agent-stubs.js` inserts package-controlled instructions into agent control files.
Evidence against
  • No credential harvesting or exfiltration appears in lifecycle source.
  • No remote code loading, eval, or binary/native loading found.
  • Runtime survey API calls are package-aligned SDK behavior.
  • CLI shell/package-manager actions are user-invoked commands, not lifecycle actions.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
NoLicense
scanned 7 file(s), 382 KB of source, external domains: custom-p0.feedbook.me, distribution-dashboard-three.vercel.app, nodejs.org, raw.githubusercontent.com

Source & flagged code

8 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli/index.jsView file
1#!/usr/bin/env node L2: "use strict";var Di=Object.create;var It=Object.defineProperty;var _i=Object.getOwnPropertyDescriptor;var Oi=Object.getOwnPropertyNames;var Ni=Object.getPrototypeOf,Mi=Object.proto... L3: `).length}function wt(e,t,n){let o=new Set;if(t==="fastPath"){let i=e.fastPath;for(let r of i?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(s=>String(s.i...
High
Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: "use strict";var Di=Object.create;var It=Object.defineProperty;var _i=Object.getOwnPropertyDescriptor;var Oi=Object.getOwnPropertyNames;var Ni=Object.getPrototypeOf,Mi=Object.proto... L3: `).length}function wt(e,t,n){let o=new Set;if(t==="fastPath"){let i=e.fastPath;for(let r of i?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(s=>String(s.i... ... L7: `,"utf8"),console.log(` L8: ${R.green}OK:${R.reset} Wrote docInventory to MANIFEST.json`)}return s.ok||e.warnOnly?0:e.ci||s.slow.length>0?1:0}function Lt(e){let t=e??kt(),n=Rt(t),o=wt(n,"fastPath"),i=Et(t,o,"... L9:
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: "use strict";var Di=Object.create;var It=Object.defineProperty;var _i=Object.getOwnPropertyDescriptor;var Oi=Object.getOwnPropertyNames;var Ni=Object.getPrototypeOf,Mi=Object.proto... L3: `).length}function wt(e,t,n){let o=new Set;if(t==="fastPath"){let i=e.fastPath;for(let r of i?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(s=>String(s.i... L4: ${R.bold}Doc read budget audit (${s.profile})${R.reset}`),console.log("\u2500".repeat(40));for(let a of s.entries){let l=a.tier==="ok"?`${R.green}OK ${R.reset}`:a.tier==="warn"?`$... ... L7: `,"utf8"),console.log(` L8: ${R.green}OK:${R.reset} Wrote docInventory to MANIFEST.json`)}return s.ok||e.warnOnly?0:e.ci||s.slow.length>0?1:0}function Lt(e){let t=e??kt(),n=Rt(t),o=wt(n,"fastPath"),i=Et(t,o,"... L9: ... L74: Source: ${e.source}`),console.log(n),console.log(""),!1}function at(e,t,n=!1){let o=_r(t,n);return o.length?Mr({title:"INSTALL SURVEY-TYPE DEPS (run once before Phase 6)",packages:... L75: `)){let o=n.trim();if(!o||o.startsWith("#"))continue;let i=o.indexOf("=");if(i<=0)continue;let r=o.slice(0,i).trim(),s=o.slice(i+1).trim();(s.startsWith('"')&&s.endsWith('"')||s.st... L76:
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1
1#!/usr/bin/env node L2: "use strict";var Di=Object.create;var It=Object.defineProperty;var _i=Object.getOwnPropertyDescriptor;var Oi=Object.getOwnPropertyNames;var Ni=Object.getPrototypeOf,Mi=Object.proto... L3: `).length}function wt(e,t,n){let o=new Set;if(t==="fastPath"){let i=e.fastPath;for(let r of i?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(s=>String(s.i... ... L5: ${R.dim}Total: ${s.totalLines} lines across ${s.entries.length} paths${R.reset}`),s.slow.length>0){console.log(` L6: ${R.yellow}A few doc reads are taking longer than expected even from temp files:${R.reset}`);for(let a of s.slow){let l=a.hint?` \u2014 ${a.hint}`:"";console.log(` - ${a.relPath} ... L7: `,"utf8"),console.log(`
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L1
postinstall.jsView file
24Install-time AI-agent control hijack evidence: L34: L35: fs.writeFileSync(filePath, newContent, 'utf8'); L36: } ... L41: function writeClaudeMd(targetDir) { L42: const filePath = path.join(targetDir, 'CLAUDE.md'); L43: const stub = getClaudeMdStub(); ... L47: if (!canUpdateClaudeMd(existing)) { L48: console.log('Skipped CLAUDE.md (custom content outside @AGENTS.md bridge)'); L49: return; ... L51: if (existing.trim() === stub.trim()) { L52: console.log('CLAUDE.md already up to date'); L53: return; Payload evidence from postinstall/detect-agent.js: L24: */ L25: function detectAgent(env = process.env) { L26: const override = env.CFM_SDK_AGENT;
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24
templates/docs/survey-ui/verify-agent-build.shView file
•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10511 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

Findings

1 Critical5 High5 Medium6 Low
CriticalAi Agent Control Hijackpostinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli/index.js
HighSame File Env Network Executiondist/cli/index.js
HighSandbox Evasion Gated Capabilitydist/cli/index.js
HighRuntime Package Installdist/cli/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpertemplates/docs/survey-ui/verify-agent-build.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License