@godxjp/ui@18.15.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@godxjp/ui@18.15.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

374"postinstall": "node scripts/postinstall.mjs", "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

The install lifecycle automatically edits the consumer project's agent configuration.

package.jsonView on unpkg · L374

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/_agent-setup.mjsView file

6Install-time code directly mutates a foreign AI-agent control surface: L6: */ L7: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L8: import { dirname, join } from "node:path"; ... L13: L14: /** Commands wired into the consumer's .claude/settings.json. */ L15: export const AUDIT_HOOK_CMD = "node node_modules/@godxjp/ui/scripts/audit-hook.mjs"; L16: export const PRIMER_CMD = "cat .claude/godxjp-ui-workflow.md"; L17: ... L42: L43: /** Delimited block appended to the consumer's CLAUDE.md — loaded into the agent's context L44: * every turn (the most reliable "ensure it reads the rules"). Markers keep it idempotent. */ L45: export const CLAUDE_MD_BLOCK = ` Write operatio

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/_agent-setup.mjsView on unpkg · L6

10/** The godxjp-ui MCP server — pulled on demand via npx (no extra dependency to ship). */ export const MCP_SERVER = { command: "npx", args: ["@godxjp/ui-mcp"] }; export const MCP_KEY = "godx-ui";

High

Ai Review Evidence

The registered server runs through npx, creating a future remote package-execution channel for the agent.

scripts/_agent-setup.mjsView on unpkg · L10

scripts/postinstall.mjsView file

14const root = process.env.INIT_CWD || process.cwd(); const skip = shouldSkip(root); if (skip) process.exit(0); // silent: CI / opt-out / self-install / no consumer project try { const r = ensureMcpJson(root); if (r === "present") process.exit(0); // already configured — stay quiet console.log( `\n @godxjp/ui → registered the godx-ui MCP in .mcp.json (${r}).\n` + " Your agent now has live component + audit guidance. Restart it to pick up the MCP.\n" +

High

Suspicious Lifecycle Evidence

The postinstall path registers an MCP server without an explicit user command.

scripts/postinstall.mjsView on unpkg · L14

Source & flagged code

6 flagged

package.jsonView file

Lines 354-394json

354 "check:mcp-token-sync": "node scripts/gen-component-tokens.mjs --check",

355 "gen:email-tokens": "node scripts/gen-email-tokens.mjs",

356 "check:email-token-sync": "node scripts/gen-email-tokens.mjs --check",

357 "check:core-isolation": "node scripts/check-core-isolation.mjs",

358 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

359 "release": "node scripts/release.mjs",

360 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

361 "preview:build": "vite build --config preview/vite.config.ts",

362 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

363 "audit": "node scripts/ui-audit.mjs",

364 "audit:examples": "node scripts/ui-audit.mjs docs",

365 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

366 "dev": "node scripts/dev.mjs",

367 "prepublishOnly": "pnpm run build",

368 "check:audit-sync": "node scripts/check-audit-sync.mjs",

369 "check:contrast": "node scripts/check-contrast.mjs",

370 "visual-audit": "node scripts/visual-audit.mjs",

371 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

372 "check:frame-axe": "node scripts/check-frame-axe.mjs",

373 "check:frame-geometry": "node scripts/frame-geometry.mjs",

374 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L374

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L374

375 "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

The install lifecycle automatically edits the consumer project's agent configuration.

package.jsonView on unpkg · L374

376 "check:use-client": "node scripts/check-use-client.mjs"

377 },

378 "peerDependencies": {

379 "@axe-core/playwright": "*",

380 "@hookform/resolvers": "^5.2.0",

381 "@tanstack/react-query": ">=5.0.0",

382 "axe-core": "*",

383 "playwright": "*",

384 "react": ">=19.0.0",

385 "react-dom": ">=19.0.0",

386 "react-hook-form": "^7.76.0",

387 "react-router-dom": ">=7.0.0",

388 "recharts": "^2.13.0 || ^3.0.0",

389 "tailwindcss": ">=4.0.0",

390 "zod": "^4.4.0"

391 },

392 "peerDependenciesMeta": {

393 "recharts": {

394 "optional": true

scripts/_agent-setup.mjsView file

Lines 1-30javascript

1/**

2 * Shared agent-setup helpers — used by both postinstall.mjs (auto, on install) and

3 * init-agent-kit.mjs (explicit, full kit). Every writer is IDEMPOTENT and

4 * NON-DESTRUCTIVE: it only creates a missing file or ADDS a missing key, never

5 * overwrites existing config.

6 */

7import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

8import { dirname, join } from

scripts/postinstall.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * postinstall — runs when a consumer installs @godxjp/ui. Auto-registers the godx-ui

4 * MCP server in the consumer's `.mcp.json` so the agent gets live access to the

5 * component catalog + audit rules WITHOUT any manual step. Non-destructive (only adds

6 * a missing server entry) and guarded so it never runs in CI or in the library's own repo.

7 *

8 * The heavier forcing-kit (the auto-audit PostToolUse hook + the workflow mandate) is

9 * left to an EXPLICIT `npx @godxjp/ui init-agent`, since hooks change the dev loop and

10 * should be opted into, not forced on install. Set GODXJP_UI_SKIP_SETUP=1 to disable.