@inizioevoke/astro-core@3.3.1: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@inizioevoke/astro-core@3.3.1: AI-agent control-surface risk | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

33"postinstall": "node postinstall.mjs" }, "files": [ "agents", "docs", "src", "po

High

Ai Review Evidence

The package automatically runs a post-install script.

package.jsonView on unpkg · L33

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/components/PdfViewer/pdf.worker.min.mjsView file

24* pdfjsBuild = 7e5b36c2d L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[1/0,1/0,-1/0,-1/0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/components/PdfViewer/pdf.worker.min.mjsView on unpkg · L24

postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L1: import { cpSync, readdirSync, rmSync } from 'fs'; L2: import { join, dirname } from 'path'; ... L8: const projectRoot = join(__dirname, '..', '..', '..'); L9: const destDir = join(projectRoot, '.claude', 'skills'); L10: const src = join(__dirname, 'agents', 'claude'); ... L15: rmSync(skillDestDir, { recursive: true, force: true }); L16: cpSync(join(src, dir), skillDestDir, { recursive: true }); L17: } Payload evidence from agents/claude/evoke-astro-core/SKILL.md: L232: L233: Custom event: `evopdfviewer-click` (fires when a custom `http://pdfviewer.evo` protocol link is clicked) L234:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

src/components/Carousel/Carousel.astroView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/components/Carousel/Carousel.astroView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 "./BottomISI": "./src/components/ISI/BottomISI/index.ts",

14 "./Carousel": "./src/components/Carousel/index.ts",

15 "./CssBackgroundImage": "./src/components/CssBackgroundImage/index.ts",

16 "./CssVariables": "./src/components/CssVariables/index.ts",

17 "./FlipCard": "./src/components/FlipCard/index.ts",

18 "./InlineImage": "./src/components/InlineImage/index.ts",

19 "./Modal": "./src/components/Modal/index.ts",

20 "./ScrollContainer": "./src/components/ScrollContainer/index.ts",

21 "./Tabs": "./src/components/Tabs/index.ts",

22

23 "./lib/BottomISI": "./src/components/ISI/BottomISI/BottomISI.ts",

24 "./lib/Carousel": "./src/components/Carousel/Carousel.ts",

25 "./lib/FlipCard": "./src/components/FlipCard/FlipCard.ts",

26 "./lib/Modal": "./src/components/Modal/Modal.ts",

27 "./lib/ScrollContainer": "./src/components/ScrollContainer/ScrollContainer.ts",

28

29 "./lib/gestures/pinch": "./src/lib/client/gestures/pinch.ts",

30 "./lib/gestures/swipe": "./src/lib/client/gestures/swipe.ts"

31 },

32 "scripts": {

33 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "files": [

36 "agents",

37 "docs",

38 "src",

39 "postinstall.mjs"

High

Ai Review Evidence

The package automatically runs a post-install script.

package.jsonView on unpkg · L33

40 ],

41 "peerDependencies": {

42 "astro": ">=5.0.0",

43 "typescript": ">=5.0.0"

44 },

45 "devDependencies": {

46 "@astrojs/check": "^0.9.8",

47 "@astrojs/ts-plugin": "^1.10.7",

48 "@types/node": "^25.5.0",

49 "astro": "^6.0.5",

50 "pdfjs-dist": "^5.7.284",

51 "typescript": "^5.9.3"

52 }

53}

src/components/PdfViewer/pdf.worker.min.mjsView file

24* pdfjsBuild = 7e5b36c2d L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[1/0,1/0,-1/0,-1/0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/components/PdfViewer/pdf.worker.min.mjsView on unpkg · L24

postinstall.mjsView file

Lines 1-19javascript

1import { cpSync, readdirSync, rmSync } from 'fs';

2import { join, dirname } from 'path';

3import { fileURLToPath } from 'url';

4

5const __dirname =

src/components/Carousel/Carousel.astroView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/components/Carousel/Carousel.astroView on unpkg