registry / @lawkit/ui / 0.1.74

@lawkit/ui@0.1.74

LDS Design System — React component library with design tokens

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies AI-agent instruction files in the consumer project. It can add package-authored guidance to Claude, Cursor, and Copilot control surfaces.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation executes the postinstall lifecycle hook.

Impact

AI coding tools may consume package-authored instructions in the consumer project.

Mechanism

Unconsented postinstall writes to consumer AI-agent configuration files.

Policy narrative

The package declares a postinstall hook that runs automatically during installation. The hook uses the install working directory as the consumer project root, then appends a reference to CLAUDE.md, creates a Cursor rule, and appends Copilot instructions when the corresponding files or directory exist. These changes alter foreign AI-agent control surfaces without an explicit user command or consent.

AI rationale

This is concrete, automatic postinstall mutation of multiple foreign AI-agent control surfaces. The absence of exfiltration does not neutralize the unconsented control-surface writes.

Evidence

package.jsonscripts/postinstall.jsCLAUDE.md.cursor/rules/lds.mdc.github/copilot-instructions.mdnode_modules/@lawkit/ui/CLAUDE.md

@lawkit/ui@0.1.74

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code