Loading npm security reports…

@godxjp/ui@20.2.1: AI-agent control-surface risk | LPM Firewall

registry / @godxjp/ui / 20.2.1

@godxjp/ui@20.2.1

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the package alters a consumer project's AI-agent configuration without an explicit setup command. It registers an MCP server that invokes another package through npx and adds persistent agent guidance.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install or update outside CI without the package-specific opt-out variable

Impact

A dependency automatically changes how agents operating in the consumer project receive tools and instructions, including deferred execution of another package through npx.

Mechanism

postinstall writes MCP and AI-agent control files

Policy narrative

Installing the UI library invokes postinstall. That code writes an MCP entry into the consumer project which launches @godxjp/ui-mcp with npx, then creates or refreshes CLAUDE.md, workflow, and AI rules files. These are foreign AI-agent control surfaces changed without an explicit user setup action; the configuration persists after installation and can affect later agent sessions.

AI rationale

This is concrete, unconsented postinstall mutation of broad consumer AI-agent control surfaces, not ordinary UI-library setup. The deferred npx MCP command compounds the supply-chain exposure.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjs.mcp.jsonCLAUDE.md.claude/godxjp-ui-workflow.md.ai/rules/godxjp-ui.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

docs/data-display/credential-reveal.tsxView file

116patternName = stripe_webhook_secret severity = high line = 116

High

High Secret

Package contains a high-severity secret pattern.

docs/data-display/credential-reveal.tsxView on unpkg · L116

116patternName = stripe_webhook_secret severity = high line = 116

High

Secret Pattern

Stripe webhook signing secret in docs/data-display/credential-reveal.tsx

docs/data-display/credential-reveal.tsxView on unpkg · L116

scripts/postinstall.mjsView file

2Install-time code directly mutates a foreign AI-agent control surface: L2: /** L3: * Auto-registers the godx-ui MCP server in the consumer's `.mcp.json` so the agent gets live L4: * access to the component catalog + audit rules WITHOUT any manual step. Non-destructive (only ... L22: const r = ensureMcpJson(root); L23: // The mandate is plain text the agent reads every turn (CLAUDE.md block + workflow file). It L24: // changes nothing in the dev loop, so it is installed by default: an agent that never saw the ... L31: console.log( L32: `\n @godxjp/ui → MCP in .mcp.json (${r}); workflow mandate in CLAUDE.md (${md}).\n` + L33: (rules ? ` common consumer rules in .ai/rules/godxjp-ui.md (glob ${rules}/**).\n` : "") + Write operation from scripts/_agent-setup.mjs: L7: import { createHash } fro

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

docs/data-display/credential-reveal.tsxView file

Lines 96-136tsx

96 <CardTitle level={2}>Tone</CardTitle>

97 <CardDescription>

98 警告帯の severity は tone。warning（既定）は保管を促す通常の一度きり表示、destructive

99 は失効・再発行が必要な重大な扱い、info は運用上の補足に使います。

100 </CardDescription>

101 </CardHeader>

102 <CardContent>

103 <Flex direction="col" gap="md">

104 <CredentialReveal

105 label="サービスアカウント鍵"

106 secret="svc_3pS5yJ8Fh2kQ9wR7nZ1xV4bT"

107 tone="warning"

108 />

109 <CredentialReveal

110 label="デバイス資格情報"

111 secret="dev_7h2K9wR7nZ1xV4bT6mL0cD"

112 tone="destructive"

113 />

114 <CredentialReveal

115 label="Webhook 署名シークレット"

116 secret="whsec_1xV4bT6mL0cD3pS5yJ8Fh2kQ"

High

High Secret

Package contains a high-severity secret pattern.

docs/data-display/credential-reveal.tsxView on unpkg · L116

High

Secret Pattern

Stripe webhook signing secret in docs/data-display/credential-reveal.tsx

docs/data-display/credential-reveal.tsxView on unpkg · L116

117 tone="info"

118 warning="このシークレットは Webhook 署名の検証にのみ使用します。"

119 />

120 </Flex>

121 </CardContent>

122 </Card>

123

124 <Card>

125 <CardHeader>

126 <CardTitle level={2}>Size</CardTitle>

127 <CardDescription>

128 size は資格情報行の高さと操作ボタンの寸法を決めます。xs / sm

129 は明細行や設定表の中に、md （既定）は単独のカードに、lg

130 は発行直後のダイアログで使います。

131 </CardDescription>

132 </CardHeader>

133 <CardContent>

134 <Flex direction="col" gap="md">

135 <CredentialReveal label="xs" secret="key_xs_9wR7nZ1xV4bT6mL0cD" size="xs" />

136 <CredentialReveal label="sm" secret="key_sm_9wR7nZ1xV4bT6mL0cD" size="sm" />

scripts/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * Auto-registers the godx-ui MCP server in the consumer's `.mcp.json` so the agent gets live

4 * access to the component catalog + audit rules WITHOUT any manual step. Non-destructive (only

5 * adds a missing server entry) and guarded so it never runs in CI or in the library's own repo.

6 */

7import {

8 ensureClaudeMd,

9 ensureMcpJson,

10 ensureConsumerRules,

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg