Loading npm security reports…

@godxjp/ui@19.0.0: AI-agent control-surface risk | LPM Firewall

registry / @godxjp/ui / 19.0.0

@godxjp/ui@19.0.0

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically adds an MCP server entry to the consumer project's agent configuration. The entry launches another package through npx when the agent uses it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of @godxjp/ui in a consumer project.

Impact

It changes a broad AI-agent control surface without installation-time consent and can cause later execution of @godxjp/ui-mcp.

Mechanism

Postinstall writes a consumer MCP configuration entry that runs npx.

Policy narrative

The package's postinstall hook runs automatically in a consumer project and calls ensureMcpJson. That function creates or modifies .mcp.json to register godx-ui with an npx command for @godxjp/ui-mcp. This is an unconsented install-time change to an AI-agent control surface and creates a later execution path outside the UI library's normal runtime. The shared module also contains writers for Claude hooks and instruction files, although those are invoked by the explicit init-agent command.

Rationale

The automatic lifecycle hook mutates the consumer's broad MCP agent configuration and registers an npx-delivered executable channel. This meets the install-time AI-agent control-surface abuse boundary despite guards and the separate explicit hook setup.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjs.mcp.json.claude/settings.json.claude/godxjp-ui-workflow.mdCLAUDE.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

389"postinstall": "node scripts/postinstall.mjs", "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

An automatic postinstall lifecycle script runs during consumer installation.

package.jsonView on unpkg · L389

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/_agent-setup.mjsView file

6Install-time code directly mutates a foreign AI-agent control surface: L6: */ L7: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L8: import { dirname, join } from "node:path"; ... L13: L14: /** Commands wired into the consumer's .claude/settings.json. */ L15: export const AUDIT_HOOK_CMD = "node node_modules/@godxjp/ui/scripts/audit-hook.mjs"; L16: export const PRIMER_CMD = "cat .claude/godxjp-ui-workflow.md"; L17: ... L42: L43: /** Delimited block appended to the consumer's CLAUDE.md — loaded into the agent's context L44: * every turn (the most reliable "ensure it reads the rules"). Markers keep it idempotent. */ L45: export const CLAUDE_MD_BLOCK = ` Write operatio

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/_agent-setup.mjsView on unpkg · L6

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg

scripts/postinstall.mjsView file

12import { ensureMcpJson, shouldSkip } from "./_agent-setup.mjs"; const root = process.env.INIT_CWD || process.cwd(); const skip = shouldSkip(root); if (skip) process.exit(0); // silent: CI / opt-out / self-install / no consumer project try { const r = ensureMcpJson(root);

High

Suspicious Lifecycle Evidence

The lifecycle handler creates or changes the consumer project's .mcp.json without an explicit command.

scripts/postinstall.mjsView on unpkg · L12

Source & flagged code

6 flagged

package.jsonView file

Lines 369-409json

369 "check:email-token-sync": "node scripts/gen-email-tokens.mjs --check",

370 "check:core-isolation": "node scripts/check-core-isolation.mjs",

371 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

372 "release": "node scripts/release.mjs",

373 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

374 "preview:build": "vite build --config preview/vite.config.ts && node scripts/gen-registry.mjs",

375 "gen:registry": "node scripts/gen-registry.mjs",

376 "check:registry": "node scripts/gen-registry.mjs --check",

377 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

378 "audit": "node scripts/ui-audit.mjs",

379 "audit:examples": "node scripts/ui-audit.mjs docs",

380 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

381 "dev": "node scripts/dev.mjs",

382 "prepublishOnly": "pnpm run build",

383 "check:audit-sync": "node scripts/check-audit-sync.mjs",

384 "check:contrast": "node scripts/check-contrast.mjs",

385 "visual-audit": "node scripts/visual-audit.mjs",

386 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

387 "check:frame-axe": "node scripts/check-frame-axe.mjs",

388 "check:frame-geometry": "node scripts/frame-geometry.mjs",

389 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L389

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L389

390 "init-agent": "node scripts/init-agent-kit.mjs",

High

Suspicious Lifecycle Evidence

An automatic postinstall lifecycle script runs during consumer installation.

package.jsonView on unpkg · L389

391 "check:use-client": "node scripts/check-use-client.mjs"

392 },

393 "peerDependencies": {

394 "@axe-core/playwright": "*",

395 "@hookform/resolvers": "^5.2.0",

396 "@tanstack/react-query": ">=5.0.0",

397 "axe-core": "*",

398 "playwright": "*",

399 "react": ">=19.0.0",

400 "react-dom": ">=19.0.0",

401 "react-hook-form": "^7.76.0",

402 "react-router-dom": ">=7.0.0",

403 "recharts": "^2.13.0 || ^3.0.0",

404 "tailwindcss": ">=4.0.0",

405 "zod": "^4.4.0"

406 },

407 "peerDependenciesMeta": {

408 "recharts": {

409 "optional": true

scripts/_agent-setup.mjsView file

Lines 1-26javascript

1/**

2 * Shared agent-setup helpers — used by both postinstall.mjs (auto, on install) and

3 * init-agent-kit.mjs (explicit, full kit). Every writer is IDEMPOTENT and

4 * NON-DESTRUCTIVE: it only creates a missing file or ADDS a missing key, never

5 * overwrites existing config.

6 */

7import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

8import { dirname, join } from

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg

scripts/postinstall.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * postinstall — runs when a consumer installs @godxjp/ui. Auto-registers the godx-ui

4 * MCP server in the consumer's `.mcp.json` so the agent gets live access to the

5 * component catalog + audit rules WITHOUT any manual step. Non-destructive (only adds

6 * a missing server entry) and guarded so it never runs in CI or in the library's own repo.

7 *

8 * The heavier forcing-kit (the auto-audit PostToolUse hook + the workflow mandate) is

9 * left to an EXPLICIT `npx @godxjp/ui init-agent`, since hooks change the dev loop and

10 * should be opted into, not forced on install. Set GODXJP_UI_SKIP_SETUP=1 to disable.