Loading npm security reports…

@godxjp/ui@23.4.5: AI-agent control-surface risk | LPM Firewall

registry / @godxjp/ui / 23.4.5

@godxjp/ui@23.4.5

@godxjp/ui — shared React UI framework (shadcn + Radix + Tailwind v4).

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies a consumer project's AI-agent configuration and instructions. It registers an MCP command and writes persistent workflow content without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation or update, which runs postinstall.

Impact

A dependency can alter how a consumer's AI agent starts, what instructions it receives, and which MCP command it launches.

Mechanism

Postinstall writes MCP configuration, CLAUDE.md guidance, and AI rule files.

Policy narrative

On installation, postinstall selects the consumer project root and calls helpers that add an MCP server, append or refresh a CLAUDE.md mandate, create a workflow file, and write AI rules based on project directories. These changes occur before the user invokes the advertised init-agent command. The resulting configuration persists in the consumer project and can influence future agent sessions.

AI rationale

This is an unconsented postinstall mutation of a foreign AI-agent control surface. The source establishes concrete persistent configuration writes, so it meets the blocking policy despite no observed exfiltration.

Evidence

package.jsonscripts/postinstall.mjsscripts/_agent-setup.mjs.mcp.jsonCLAUDE.md.claude/godxjp-ui-workflow.md.ai/rules/godxjp-ui.md.prettierignore.ai/rules/index.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

docs/data-display/credential-reveal.tsxView file

116patternName = stripe_webhook_secret severity = high line = 116

High

High Secret

Package contains a high-severity secret pattern.

docs/data-display/credential-reveal.tsxView on unpkg · L116

116patternName = stripe_webhook_secret severity = high line = 116

High

Secret Pattern

Stripe webhook signing secret in docs/data-display/credential-reveal.tsx

docs/data-display/credential-reveal.tsxView on unpkg · L116

scripts/postinstall.mjsView file

2Install-time code directly mutates a foreign AI-agent control surface: L2: /** L3: * Auto-registers the godx-ui MCP server in the consumer's `.mcp.json` so the agent gets live L4: * access to the component catalog + audit rules WITHOUT any manual step. Non-destructive (only ... L23: // A refusal is a full sentence, not one of the three status words — say it on its own line L24: // rather than folding it into "MCP in .mcp.json (…)", where it would read as a success. L25: if (r.startsWith("left untouched") || r.startsWith("present (custom godx-ui")) { L26: console.log(`\n @godxjp/ui → .mcp.json ${r}\n`); L27: } L28: // The mandate is plain text the agent reads every turn (CLAUDE.md block + workflow file). It L29: // changes nothing in the dev loop, so it is installed by default: an agent th

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg

scripts/_agent-setup.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 41be20da1a7ec641 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @godxjp/ui@23.4.4 matchedPath = scripts/_agent-setup.mjs matchedIdentity = npm:QGdvZHhqcC91aQ:23.4.4 similarity = 1.000 shingleOverlap = 29 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/_agent-setup.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

docs/data-display/credential-reveal.tsxView file

116patternName = stripe_webhook_secret severity = high line = 116

High

High Secret

Package contains a high-severity secret pattern.

docs/data-display/credential-reveal.tsxView on unpkg · L116

116patternName = stripe_webhook_secret severity = high line = 116

High

Secret Pattern

Stripe webhook signing secret in docs/data-display/credential-reveal.tsx

docs/data-display/credential-reveal.tsxView on unpkg · L116

scripts/postinstall.mjsView file

2Install-time code directly mutates a foreign AI-agent control surface: L2: /** L3: * Auto-registers the godx-ui MCP server in the consumer's `.mcp.json` so the agent gets live L4: * access to the component catalog + audit rules WITHOUT any manual step. Non-destructive (only ... L23: // A refusal is a full sentence, not one of the three status words — say it on its own line L24: // rather than folding it into "MCP in .mcp.json (…)", where it would read as a success. L25: if (r.startsWith("left untouched") || r.startsWith("present (custom godx-ui")) { L26: console.log(`\n @godxjp/ui → .mcp.json ${r}\n`); L27: } L28: // The mandate is plain text the agent reads every turn (CLAUDE.md block + workflow file). It L29: // changes nothing in the dev loop, so it is installed by default: an agent th

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L2

dist/i18n/messages/en.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/i18n/messages/en.jsonView on unpkg

scripts/_agent-setup.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 41be20da1a7ec641 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @godxjp/ui@23.4.4 matchedPath = scripts/_agent-setup.mjs matchedIdentity = npm:QGdvZHhqcC91aQ:23.4.4 similarity = 1.000 shingleOverlap = 29 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/_agent-setup.mjsView on unpkg