Loading npm security reports…

@godxjp/ui@18.13.0: AI-agent control-surface risk | LPM Firewall

registry / @godxjp/ui / 18.13.0

@godxjp/ui@18.13.0

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's MCP configuration. This injects an agent server command that later invokes another package through npx.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

A dependency silently changes an AI-agent control surface and causes future agent sessions to execute a remotely resolved MCP package.

Mechanism

Automatic MCP configuration injection into the consumer project.

Policy narrative

On installation, the postinstall hook selects the consumer working directory and calls the MCP setup helper. The helper creates or changes .mcp.json to add a godx-ui server whose command is npx @godxjp/ui-mcp. This is not an explicit setup action by the consumer and alters the project-wide AI-agent execution configuration. Although the separate hook and instruction installation requires an explicit command, the automatic MCP registration alone creates an unconsented agent control path.

Rationale

The package automatically mutates a consumer AI-agent control surface during postinstall and configures it to execute another package through npx. This meets the install-time control-surface abuse boundary despite the absence of observed secret theft.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjsscripts/init-agent-kit.mjs.mcp.json.claude/settings.json.claude/godxjp-ui-workflow.mdCLAUDE.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

374"postinstall": "node scripts/postinstall.mjs", "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

The install lifecycle runs a project-mutating setup script automatically.

package.jsonView on unpkg · L374

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/_agent-setup.mjsView file

6Install-time code directly mutates a foreign AI-agent control surface: L6: */ L7: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L8: import { dirname, join } from "node:path"; ... L13: L14: /** Commands wired into the consumer's .claude/settings.json. */ L15: export const AUDIT_HOOK_CMD = "node node_modules/@godxjp/ui/scripts/audit-hook.mjs"; L16: export const PRIMER_CMD = "cat .claude/godxjp-ui-workflow.md"; L17: ... L42: L43: /** Delimited block appended to the consumer's CLAUDE.md — loaded into the agent's context L44: * every turn (the most reliable "ensure it reads the rules"). Markers keep it idempotent. */ L45: export const CLAUDE_MD_BLOCK = ` Write operatio

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/_agent-setup.mjsView on unpkg · L6

10/** The godxjp-ui MCP server — pulled on demand via npx (no extra dependency to ship). */ export const MCP_SERVER = { command: "npx", args: ["@godxjp/ui-mcp"] }; export const MCP_KEY = "godx-ui";

High

Ai Review Evidence

The registered server is launched through npx, allowing an additional package to run when the agent starts.

scripts/_agent-setup.mjsView on unpkg · L10

scripts/postinstall.mjsView file

14const root = process.env.INIT_CWD || process.cwd(); const skip = shouldSkip(root); if (skip) process.exit(0); // silent: CI / opt-out / self-install / no consumer project try { const r = ensureMcpJson(root);

High

Suspicious Lifecycle Evidence

The postinstall script registers an MCP server in the consumer project without an explicit user command.

scripts/postinstall.mjsView on unpkg · L14

Source & flagged code

6 flagged

package.jsonView file

Lines 354-394json

354 "check:mcp-token-sync": "node scripts/gen-component-tokens.mjs --check",

355 "gen:email-tokens": "node scripts/gen-email-tokens.mjs",

356 "check:email-token-sync": "node scripts/gen-email-tokens.mjs --check",

357 "check:core-isolation": "node scripts/check-core-isolation.mjs",

358 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

359 "release": "node scripts/release.mjs",

360 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

361 "preview:build": "vite build --config preview/vite.config.ts",

362 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

363 "audit": "node scripts/ui-audit.mjs",

364 "audit:examples": "node scripts/ui-audit.mjs docs",

365 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

366 "dev": "node scripts/dev.mjs",

367 "prepublishOnly": "pnpm run build",

368 "check:audit-sync": "node scripts/check-audit-sync.mjs",

369 "check:contrast": "node scripts/check-contrast.mjs",

370 "visual-audit": "node scripts/visual-audit.mjs",

371 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

372 "check:frame-axe": "node scripts/check-frame-axe.mjs",

373 "check:frame-geometry": "node scripts/frame-geometry.mjs",

374 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L374

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L374

375 "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

The install lifecycle runs a project-mutating setup script automatically.

package.jsonView on unpkg · L374

376 "check:use-client": "node scripts/check-use-client.mjs"

377 },

378 "peerDependencies": {

379 "@axe-core/playwright": "*",

380 "@hookform/resolvers": "^5.2.0",

381 "@tanstack/react-query": ">=5.0.0",

382 "axe-core": "*",

383 "playwright": "*",

384 "react": ">=19.0.0",

385 "react-dom": ">=19.0.0",

386 "react-hook-form": "^7.76.0",

387 "react-router-dom": ">=7.0.0",

388 "recharts": "^2.13.0 || ^3.0.0",

389 "tailwindcss": ">=4.0.0",

390 "zod": "^4.4.0"

391 },

392 "peerDependenciesMeta": {

393 "recharts": {

394 "optional": true

scripts/_agent-setup.mjsView file

Lines 1-30javascript

1/**

2 * Shared agent-setup helpers — used by both postinstall.mjs (auto, on install) and

3 * init-agent-kit.mjs (explicit, full kit). Every writer is IDEMPOTENT and

4 * NON-DESTRUCTIVE: it only creates a missing file or ADDS a missing key, never

5 * overwrites existing config.

6 */

7import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

8import { dirname, join } from

scripts/postinstall.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * postinstall — runs when a consumer installs @godxjp/ui. Auto-registers the godx-ui

4 * MCP server in the consumer's `.mcp.json` so the agent gets live access to the

5 * component catalog + audit rules WITHOUT any manual step. Non-destructive (only adds

6 * a missing server entry) and guarded so it never runs in CI or in the library's own repo.

7 *

8 * The heavier forcing-kit (the auto-audit PostToolUse hook + the workflow mandate) is

9 * left to an EXPLICIT `npx @godxjp/ui init-agent`, since hooks change the dev loop and

10 * should be opted into, not forced on install. Set GODXJP_UI_SKIP_SETUP=1 to disable.