registry / AI-agent control-surface risk / @ploomescrm/bridge

@ploomescrm/bridge

Bridge de comunicação tipado e **agnóstico de transporte** entre uma aplicação host e os apps que ela embute — um `<iframe>` no web, uma `<WebView>` no mobile.

This report shows the evidence for @ploomescrm/bridge@1.1.1. 1 of 4 known versions is blocked or flagged. The newest version, 1.1.4, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package performs a concrete, automatic postinstall mutation of the consuming project's broad Claude Code extension and instruction directories. This meets the blocking policy even though the current extension text appears package-aligned and no exfiltration was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall when installed as a dependency

Impact

A package install can activate package-supplied Claude Code instructions and extensions in the consumer project.

Mechanism

postinstall copies package-controlled AI extensions into consumer .claude and rewrites .claude/CLAUDE.md

Policy narrative

On npm postinstall, scripts/setup.mjs identifies the consumer root via INIT_CWD, copies package-controlled AI extension categories into .claude, deletes prior prefixed entries, and adds a generated import to .claude/CLAUDE.md. This is unconsented install-time mutation of a foreign AI-agent control surface; no separate network or credential-exfiltration chain was found.

AI rationale

Evidence

package.jsonscripts/setup.mjsai-extensions/CLAUDE.mdai-extensions/skills/use-bridge/SKILL.mddist/index.mjsdist/index.cjsai-extensions/skills/use-bridge/<consumer-project>/.claude/CLAUDE.md<consumer-project>/.claude/skills/<consumer-project>/.claude/agents/<consumer-project>/.claude/commands/<consumer-project>/.claude/output-styles/

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json defines postinstall: node scripts/setup.mjs.
scripts/setup.mjs runs when installed from node_modules.
It writes consumer .claude/CLAUDE.md and imports package content.
It copies extension categories into consumer .claude/skills, agents, commands, and output-styles.
It removes prior consumer .claude entries matching its prefix during install/update.

Evidence against

No network endpoints or HTTP client usage found.
No child-process, eval, dynamic loading, or credential harvesting found.
Published extension content documents bridge usage rather than a payload.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

Minified

Manifest

NoLicense

scanned 4 file(s), 28.9 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 35-69json

35 "devDependencies": {

36 "@changesets/cli": "^2.31.0",

37 "@eslint/js": "^10.0.1",

38 "@vitest/coverage-v8": "^4.1.9",

39 "eslint": "^10.4.1",

40 "eslint-config-prettier": "^10.1.8",

41 "globals": "^17.6.0",

42 "happy-dom": "^20.10.6",

43 "prettier": "^3.8.4",

44 "tsdown": "^0.22.3",

45 "typescript": "^6.0.3",

46 "typescript-eslint": "^8.60.1",

47 "unrun": "^0.3.1",

48 "vite": "8.0.16",

49 "vitest": "^4.1.9"

50 },

51 "publishConfig": {

52 "access": "public"

53 },

54 "scripts": {

55 "postinstall": "node scripts/setup.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

56 "build": "tsdown",

57 "dev": "tsdown --watch",

58 "typecheck": "tsc --noEmit",

59 "test": "vitest run",

60 "test:watch": "vitest",

61 "test:coverage": "vitest run --coverage",

62 "lint": "eslint . --max-warnings 0",

63 "format": "prettier --write \"**/*.{ts,js,mjs,json,md,yaml,yml}\"",

64 "format:check": "prettier --check \"**/*.{ts,js,mjs,json,md,yaml,yml}\"",

65 "change": "changeset",

66 "version-packages": "changeset version",

67 "release": "pnpm build && changeset publish"

68 }

69}

scripts/setup.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/**

3 * postinstall — mirrors the extensions declared by the `ploomesAiExtensions`

4 * manifest in package.json into a consumer project's `.claude/`, each item

5 * prefixed so it coexists with the project's own content. Only acts when

6 * installed as a dependency; inert during local development.

7 *

8 * Claude Code only discovers skills that are direct children of

9 * `.claude/skills/` (i.e. `.claude/skills/<name>/SKILL.md`), so items are

10 * flattened with a prefix rather than nested under a namespace directory:

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/setup.mjsView file

3* postinstall — mirrors the extensions declared by the `ploomesAiExtensions` L4: * manifest in package.json into a consumer project's `.claude/`, each item L5: * prefixed so it coexists with the project's own content. Only acts when ... L8: * Claude Code only discovers skills that are direct children of L9: * `.claude/skills/` (i.e. `.claude/skills/<name>/SKILL.md`), so items are L10: * flattened with a prefix rather than nested under a namespace directory: ... L12: * ai-extensions/skills/use-bridge/SKILL.md L13: * -> .claude/skills/ploomes-bridge-use-bridge/SKILL.md L14: */ ... L16: import { L17: cpSync, L18: existsSync,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.mjsView on unpkg · L3

Findings

1 Critical1 High2 Medium3 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to @ploomescrm/bridge@1.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing @ploomescrm/bridge@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-08 11:30:55.194Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

1.1.4latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 14, 2026, 4:58 PM 1.1.2SuspiciousAgent extension lifecycle riskWarnPublishedAug 7, 2026, 7:37 PM 1.1.1shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 7, 2026, 7:09 PM 1.1.0SuspiciousAgent extension lifecycle riskWarnPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

More from @ploomescrm

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

More from @ploomescrm

Other AI-agent control-surface risk packages

Source & flagged code