Loading npm security reports…

@godxjp/ui@18.11.0: AI-agent control-surface risk | LPM Firewall

registry / @godxjp/ui / 18.11.0

@godxjp/ui@18.11.0

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's MCP configuration. That configuration causes a separate package to be launched through npx when an agent uses the registered server.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs postinstall in a consumer project.

Impact

A dependency silently adds an AI-agent execution channel to the consumer project and can cause later retrieval and execution of another package.

Mechanism

Automatic MCP configuration injection that launches an npx package.

Policy narrative

During installation, the postinstall script calls ensureMcpJson for the consumer project. That function creates or edits .mcp.json and registers a godx-ui server configured to run npx @godxjp/ui-mcp. The mutation occurs without an explicit user setup command and establishes an agent control channel that later resolves and executes another package. Although the fuller Claude hook kit requires an explicit command, the automatic MCP injection alone alters a broad agent configuration surface.

Rationale

This package uses an automatic postinstall hook to add a consumer-wide MCP server that launches another npm package through npx. That is an unconsented install-time mutation of an AI-agent control surface.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjsscripts/init-agent-kit.mjs.mcp.json

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

373"postinstall": "node scripts/postinstall.mjs", "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

The postinstall hook runs automatically during consumer installation.

package.jsonView on unpkg · L373

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/_agent-setup.mjsView file

6Install-time code directly mutates a foreign AI-agent control surface: L6: */ L7: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L8: import { dirname, join } from "node:path"; ... L13: L14: /** Commands wired into the consumer's .claude/settings.json. */ L15: export const AUDIT_HOOK_CMD = "node node_modules/@godxjp/ui/scripts/audit-hook.mjs"; L16: export const PRIMER_CMD = "cat .claude/godxjp-ui-workflow.md"; L17: ... L42: L43: /** Delimited block appended to the consumer's CLAUDE.md — loaded into the agent's context L44: * every turn (the most reliable "ensure it reads the rules"). Markers keep it idempotent. */ L45: export const CLAUDE_MD_BLOCK = ` Write operatio

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/_agent-setup.mjsView on unpkg · L6

10/** The godxjp-ui MCP server — pulled on demand via npx (no extra dependency to ship). */ export const MCP_SERVER = { command: "npx", args: ["@godxjp/ui-mcp"] }; export const MCP_KEY = "godx-ui";

High

Ai Review Evidence

The injected MCP configuration runs npx @godxjp/ui-mcp when an agent loads it.

scripts/_agent-setup.mjsView on unpkg · L10

scripts/postinstall.mjsView file

19try { const r = ensureMcpJson(root); if (r === "present") process.exit(0); // already configured — stay quiet console.log( `\n @godxjp/ui → registered the godx-ui MCP in .mcp.json (${r}).\n` + " Your agent now has live component + audit guidance. Restart it to pick up the MCP.\n" +

High

Suspicious Lifecycle Evidence

Postinstall writes a godx-ui MCP server entry into the consumer project's .mcp.json without an explicit command.

scripts/postinstall.mjsView on unpkg · L19

Source & flagged code

6 flagged

package.jsonView file

Lines 353-393json

353 "check:mcp-token-sync": "node scripts/gen-component-tokens.mjs --check",

354 "gen:email-tokens": "node scripts/gen-email-tokens.mjs",

355 "check:email-token-sync": "node scripts/gen-email-tokens.mjs --check",

356 "check:core-isolation": "node scripts/check-core-isolation.mjs",

357 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

358 "release": "node scripts/release.mjs",

359 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

360 "preview:build": "vite build --config preview/vite.config.ts",

361 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

362 "audit": "node scripts/ui-audit.mjs",

363 "audit:examples": "node scripts/ui-audit.mjs docs",

364 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

365 "dev": "node scripts/dev.mjs",

366 "prepublishOnly": "pnpm run build",

367 "check:audit-sync": "node scripts/check-audit-sync.mjs",

368 "check:contrast": "node scripts/check-contrast.mjs",

369 "visual-audit": "node scripts/visual-audit.mjs",

370 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

371 "check:frame-axe": "node scripts/check-frame-axe.mjs",

372 "check:frame-geometry": "node scripts/frame-geometry.mjs",

373 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L373

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L373

374 "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

The postinstall hook runs automatically during consumer installation.

package.jsonView on unpkg · L373

375 "check:use-client": "node scripts/check-use-client.mjs"

376 },

377 "peerDependencies": {

378 "@axe-core/playwright": "*",

379 "@hookform/resolvers": "^5.2.0",

380 "@tanstack/react-query": ">=5.0.0",

381 "axe-core": "*",

382 "playwright": "*",

383 "react": ">=19.0.0",

384 "react-dom": ">=19.0.0",

385 "react-hook-form": "^7.76.0",

386 "react-router-dom": ">=7.0.0",

387 "recharts": "^2.13.0 || ^3.0.0",

388 "tailwindcss": ">=4.0.0",

389 "zod": "^4.4.0"

390 },

391 "peerDependenciesMeta": {

392 "recharts": {

393 "optional": true

scripts/_agent-setup.mjsView file

Lines 1-30javascript

1/**

2 * Shared agent-setup helpers — used by both postinstall.mjs (auto, on install) and

3 * init-agent-kit.mjs (explicit, full kit). Every writer is IDEMPOTENT and

4 * NON-DESTRUCTIVE: it only creates a missing file or ADDS a missing key, never

5 * overwrites existing config.

6 */

7import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

8import { dirname, join } from

scripts/postinstall.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * postinstall — runs when a consumer installs @godxjp/ui. Auto-registers the godx-ui

4 * MCP server in the consumer's `.mcp.json` so the agent gets live access to the

5 * component catalog + audit rules WITHOUT any manual step. Non-destructive (only adds

6 * a missing server entry) and guarded so it never runs in CI or in the library's own repo.

7 *

8 * The heavier forcing-kit (the auto-audit PostToolUse hook + the workflow mandate) is

9 * left to an EXPLICIT `npx @godxjp/ui init-agent`, since hooks change the dev loop and

10 * should be opted into, not forced on install. Set GODXJP_UI_SKIP_SETUP=1 to disable.