Loading npm security reports…

@godxjp/ui@21.0.0: AI-agent control-surface risk | LPM Firewall

registry / @godxjp/ui / 21.0.0

@godxjp/ui@21.0.0

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consuming project's MCP configuration and agent instruction files. The added MCP entry launches another package through npx when the agent loads it.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of @godxjp/ui

Impact

A dependency silently controls an agent's available tool channel and instructions, and can cause later execution of an unpinned external MCP package.

Mechanism

Postinstall writes MCP registration and persistent AI-agent guidance into the consumer project.

Policy narrative

On installation, package.json runs postinstall. That handler uses the consumer project as its root and automatically registers a godx-ui MCP server in .mcp.json, appends or refreshes CLAUDE.md guidance, writes a workflow file, and adds AI rules when a UI directory exists. The MCP registration uses npx @godxjp/ui-mcp, so a later agent startup can execute a separately resolved package. These are unconsented lifecycle changes to broad AI-agent control surfaces.

AI rationale

This is concrete unconsented postinstall mutation of foreign AI-agent configuration, not merely an explicit setup command. The downstream npx MCP command further expands the supply-chain execution surface.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjs.mcp.jsonCLAUDE.md.claude/godxjp-ui-workflow.md.ai/rules/godxjp-ui.md.ai/rules/index.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

docs/data-display/credential-reveal.tsxView file

116patternName = stripe_webhook_secret severity = high line = 116

High

High Secret

Package contains a high-severity secret pattern.

docs/data-display/credential-reveal.tsxView on unpkg · L116

116patternName = stripe_webhook_secret severity = high line = 116

High

Secret Pattern

Stripe webhook signing secret in docs/data-display/credential-reveal.tsx

docs/data-display/credential-reveal.tsxView on unpkg · L116

scripts/postinstall.mjsView file

2Install-time code directly mutates a foreign AI-agent control surface: L2: /** L3: * Auto-registers the godx-ui MCP server in the consumer's `.mcp.json` so the agent gets live L4: * access to the component catalog + audit rules WITHOUT any manual step. Non-destructive (only ... L22: const r = ensureMcpJson(root); L23: // The mandate is plain text the agent reads every turn (CLAUDE.md block + workflow file). It L24: // changes nothing in the dev loop, so it is installed by default: an agent that never saw the ... L31: console.log( L32: `\n @godxjp/ui → MCP in .mcp.json (${r}); workflow mandate in CLAUDE.md (${md}).\n` + L33: (rules ? ` common consumer rules in .ai/rules/godxjp-ui.md (glob ${rules}/**).\n` : "") + Write operation from scripts/_agent-setup.mjs: L7: import { createHash } fro

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 395-435json

395 "check:no-consumer-coupling": "node scripts/check-no-consumer-coupling.mjs",

396 "release": "node scripts/release.mjs",

397 "preview": "node preview/scripts/kill-port.mjs && vite --config preview/vite.config.ts --port 6008 --strictPort",

398 "preview:build": "vite build --config preview/vite.config.ts && node scripts/gen-registry.mjs",

399 "gen:registry": "node scripts/gen-registry.mjs",

400 "check:registry": "node scripts/gen-registry.mjs --check",

401 "docs:sync-primitives": "node preview/scripts/sync-primitive-docs.mjs && prettier --write \"docs/primitives/**/*.tsx\"",

402 "audit": "node scripts/ui-audit.mjs",

403 "audit:examples": "node scripts/ui-audit.mjs docs",

404 "build": "tsup && tsc -p tsconfig.build.json && node scripts/copy-styles.mjs && node scripts/fix-esm-extensions.mjs && node scripts/add-use-client.mjs",

405 "dev": "node scripts/dev.mjs",

406 "prepublishOnly": "pnpm run build",

407 "check:audit-sync": "node scripts/check-audit-sync.mjs",

408 "check:gate-coverage": "node scripts/check-gate-coverage.mjs",

409 "check:contrast": "node scripts/check-contrast.mjs",

410 "check:text-ink-clip": "node scripts/check-text-ink-clip.mjs",

411 "visual-audit": "node scripts/visual-audit.mjs",

412 "check:visual-audit": "node scripts/visual-audit-smoke.mjs",

413 "check:frame-axe": "node scripts/check-frame-axe.mjs",

414 "check:frame-geometry": "node scripts/frame-geometry.mjs",

415 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L415

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L415

416 "init-agent": "node scripts/init-agent-kit.mjs",

417 "check:use-client": "node scripts/check-use-client.mjs"

418 },

419 "peerDependencies": {

420 "@axe-core/playwright": "*",

421 "@hookform/resolvers": "^5.2.0",

422 "@tanstack/react-query": ">=5.0.0",

423 "axe-core": "*",

424 "playwright": "*",

425 "react": ">=19.0.0",

426 "react-dom": ">=19.0.0",

427 "react-hook-form": "^7.76.0",

428 "react-router-dom": ">=7.0.0",

429 "recharts": "^2.13.0 || ^3.0.0",

430 "tailwindcss": ">=4.0.0",

431 "zod": "^4.4.0"

432 },

433 "peerDependenciesMeta": {

434 "recharts": {

435 "optional": true

docs/data-display/credential-reveal.tsxView file

Lines 96-136tsx

96 <CardTitle level={2}>Tone</CardTitle>

97 <CardDescription>

98 警告帯の severity は tone。warning（既定）は保管を促す通常の一度きり表示、destructive

99 は失効・再発行が必要な重大な扱い、info は運用上の補足に使います。

100 </CardDescription>

scripts/postinstall.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2/**

3 * Auto-registers the godx-ui MCP server in the consumer's `.mcp.json` so the agent gets live

4 * access to the component catalog + audit rules WITHOUT any manual step. Non-destructive (only

5 * adds a missing server entry) and guarded so it never runs in CI or in the library's own repo.

6 */

7import {

8 ensureClaudeMd,

9 ensureMcpJson,

10 ensureConsumerRules,

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg