registry / @ploomescrm/bridge / 1.1.2

@ploomescrm/bridge@1.1.2

Bridge de comunicação tipado e **agnóstico de transporte** entre uma aplicação host e os apps que ela embute — um `<iframe>` no web, uma `<WebView>` no mobile.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Postinstall mutates the consuming project's Claude Code configuration by installing this package's namespaced skills and importing its package-owned CLAUDE.md. No network or credential-exfiltration chain was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm dependency installation (postinstall) when package is under node_modules

Impact

Claude Code in the consumer project may discover and follow package-supplied bridge documentation.

Mechanism

first-party AI-extension propagation into .claude

Rationale

The package has a real install-time AI-agent configuration surface, so it should not be marked clean. Its scoped, namespaced first-party extension setup and benign inspected contents support a warning rather than a block.

Evidence

package.jsonscripts/setup.mjsai-extensions/CLAUDE.mdai-extensions/skills/use-bridge/SKILL.mddist/index.mjsdist/index.cjsai-extensions/skills/use-bridge<consumer-project>/.claude/skills/ploomes-bridge-use-bridge<consumer-project>/.claude/CLAUDE.md

Decision evidence

public snapshot

@ploomescrm/bridge@1.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code