Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@godxjp/ui@18.8.0: AI-agent control-surface risk | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Soft block: AI-agent control surface

Warn by default; block when configured. A foreign MCP server can be activated by the consumer's AI agent, creating an unconsented remote agent-control channel.

View on npm All versions Policy details

registry / @godxjp/ui / 18.8.0

@godxjp/ui@18.8.0

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates a consumer project's AI-agent MCP configuration. It registers a server fetched on demand through npx.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation in a non-CI consumer project without GODXJP_UI_SKIP_SETUP.

Impact

A foreign MCP server can be activated by the consumer's AI agent, creating an unconsented remote agent-control channel.

Mechanism

postinstall writes a godx-ui MCP entry to .mcp.json

Policy narrative

On installation, postinstall resolves the consumer root and calls ensureMcpJson. That function creates or alters the consumer's .mcp.json to add godx-ui with command npx and package @godxjp/ui-mcp. The agent subsequently launches an externally supplied MCP package on demand, giving it an unconsented AI-agent control channel. The explicit init command adds further Claude hooks, but the MCP mutation already occurs automatically.

Rationale

Source confirms unconsented postinstall mutation of a consumer AI-agent control surface, not merely an explicit user setup command. This meets the blocking policy despite idempotence and opt-out guards.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjsscripts/init-agent-kit.mjsscripts/audit-hook.mjs.mcp.json

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json registers postinstall.
scripts/postinstall.mjs runs automatically on consumer install.
postinstall writes consumer .mcp.json unless CI/opt-out.
scripts/_agent-setup.mjs adds godx-ui server using npx @godxjp/ui-mcp.
This grants an external MCP package a consumer agent execution channel.

Evidence against

Automatic setup does not add Claude hooks or CLAUDE.md.
Writers preserve existing keys and offer an opt-out.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 252 file(s), 667 KB of source

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/_agent-setup.mjsView file

6Install-time code directly mutates a foreign AI-agent control surface: L6: */ L7: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L8: import { dirname, join } from "node:path"; ... L13: L14: /** Commands wired into the consumer's .claude/settings.json. */ L15: export const AUDIT_HOOK_CMD = "node node_modules/@godxjp/ui/scripts/audit-hook.mjs"; L16: export const PRIMER_CMD = "cat .claude/godxjp-ui-workflow.md"; L17: ... L42: L43: /** Delimited block appended to the consumer's CLAUDE.md — loaded into the agent's context L44: * every turn (the most reliable "ensure it reads the rules"). Markers keep it idempotent. */ L45: export const CLAUDE_MD_BLOCK = ` Write operatio

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/_agent-setup.mjsView on unpkg · L6

Findings

1 Critical1 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/_agent-setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

99%Soft block

Verdict confidence

TypeSoft block: AI-agent control surface

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn by default

Package metadata

npm

Version18.9.0

PublishedAug 7, 2026

Licensenone

Dependencies56

Integrityverified

Package size407 KB

Files547

Runtime surface

package.json

Entrypointsmain → ./dist/index.jsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → godxjp-ui

RuntimeNo engine / OS / CPU constraints

Artifact1.57 MB · 547 files1 signature(s)

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessEnvironmentVarsFilesystemShellHighEntropyStringsNoLicense

LPM CLI

Source & flagged code

3 flagged

package.jsonView file

Lines 340-380json

340 "check:mcp-token-sync": "node scripts/gen-component-tokens.mjs --check",

341 "gen:email-tokens": "node scripts/gen-email-tokens.mjs",

342 "check:email-token-sync": "node scripts/gen-email-tokens.mjs --check",

343 "check:core-isolation": "node scripts/check-core-isolation.mjs",

344 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

345 "release": "node scripts/release.mjs",

346 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

347 "preview:build": "vite build --config preview/vite.config.ts",

348 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

349 "audit": "node scripts/ui-audit.mjs",

350 "audit:examples": "node scripts/ui-audit.mjs docs",

351 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

352 "dev": "node scripts/dev.mjs",

353 "prepublishOnly": "pnpm run build",

354 "check:audit-sync": "node scripts/check-audit-sync.mjs",

355 "check:contrast": "node scripts/check-contrast.mjs",

356 "visual-audit": "node scripts/visual-audit.mjs",

357 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

358 "check:frame-axe": "node scripts/check-frame-axe.mjs",

359 "check:frame-geometry": "node scripts/frame-geometry.mjs",

360 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L360

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L360

361 "init-agent": "node scripts/init-agent-kit.mjs",

362 "check:use-client": "node scripts/check-use-client.mjs"

363 },

364 "peerDependencies": {

365 "@axe-core/playwright": "*",

366 "@hookform/resolvers": "^5.2.0",

367 "@tanstack/react-query": ">=5.0.0",

368 "axe-core": "*",

369 "playwright": "*",

370 "react": ">=19.0.0",

371 "react-dom": ">=19.0.0",

372 "react-hook-form": "^7.76.0",

373 "react-router-dom": ">=7.0.0",

374 "recharts": "^2.13.0 || ^3.0.0",

375 "tailwindcss": ">=4.0.0",

376 "zod": "^4.4.0"

377 },

378 "peerDependenciesMeta": {

379 "recharts": {

380 "optional": true

scripts/_agent-setup.mjsView file

Lines 1-26javascript

1/**

2 * Shared agent-setup helpers — used by both postinstall.mjs (auto, on install) and

3 * init-agent-kit.mjs (explicit, full kit). Every writer is IDEMPOTENT and

4 * NON-DESTRUCTIVE: it only creates a missing file or ADDS a missing key, never

5 * overwrites existing config.

6 */

7import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

8import { dirname, join } from

"node:path"

;

9

10/** The godxjp-ui MCP server — pulled on demand via npx (no extra dependency to ship). */

11export const MCP_SERVER = { command: "npx", args: ["@godxjp/ui-mcp"] };

12export const MCP_KEY = "godx-ui";

13

14/** Commands wired into the consumer's .claude/settings.json. */

15export const AUDIT_HOOK_CMD = "node node_modules/@godxjp/ui/scripts/audit-hook.mjs";

16export const PRIMER_CMD = "cat .claude/godxjp-ui-workflow.md";

17

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/_agent-setup.mjsView on unpkg · L6

18/** The per-session workflow mandate the SessionStart hook injects into the agent. */

19export const WORKFLOW_MD = `# @godxjp/ui — mandatory workflow (read every session)

20

21You are building UI in an app that uses @godxjp/ui. Follow this EVERY time you create

22or change a component, page, or form — no exceptions.

23

24## Before writing UI

251. **MCP-first.** Consult the godx-ui MCP: \`get_component <Name>\`, \`search_components\`,

26 \`list_audit_rules\`, \`list_visual_checks\`. Never guess a prop; never hand-roll what a