registry / AI-agent control-surface risk / @ploomescrm/ui
@ploomescrm/ui
Biblioteca de componentes React do Design System da Ploomes: componentes acessíveis, tematizáveis e prontos para produção, com tokens de design embutidos e suporte a dark mode e whitelabel em tempo de execução.
This report shows the evidence for @ploomescrm/ui@3.9.0. 3 of 10 known versions are blocked or flagged. The newest version, 3.9.1, is flagged. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource confirms that postinstall automatically modifies the consumer's project-level Claude configuration and imports package-authored guidance without affirmative consent. This meets the policy for unconsented lifecycle mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package with lifecycle scripts enabled.
Impact
The package changes the consumer's AI-agent configuration and introduces publisher-provided instructions into future agent sessions.
Mechanism
The hook copies extensions into project-level .claude folders and updates .claude/CLAUDE.md without an affirmative consent check.
Policy narrative
The manifest invokes scripts/setup.mjs during postinstall. The script identifies the consuming project root, copies package-provided extensions into its .claude configuration, and inserts an import into .claude/CLAUDE.md. These changes occur automatically without an affirmative consent check, creating an unconsented AI-agent control surface.
AI rationale
Source confirms that postinstall automatically modifies the consumer's project-level Claude configuration and imports package-authored guidance without affirmative consent. This meets the policy for unconsented lifecycle mutation of an AI-agent control surface.
Evidence
package.jsonscripts/setup.mjsai-extensions/CLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs scripts/setup.mjs automatically through its postinstall hook.
- The installer targets the consuming project's .claude directory and handles skills, agents, commands, and output styles without an affirmative consent check.
- It copies package-provided extensions into that directory and updates the consumer's .claude/CLAUDE.md to import package guidance at the top.
- The imported guidance directs AI agents to follow Ploomes UI conventions when building interfaces.
Evidence against
- The shipped guidance inspected focuses on setting up and documenting the UI library; no credential collection or network transfer was found in the reviewed files.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg77"scripts": {
"postinstall": "node scripts/setup.mjs",
"build": "tsdown
High
Suspicious Lifecycle Evidence
The package runs scripts/setup.mjs automatically through its postinstall hook.
package.jsonView on unpkg · L77scripts/setup.mjsView file
9* Mirrors each category from <src>/ flattened into the root of the consumer's
L10: * `.claude/<category>/`, prefixing each item with the lib name (skills are only
L11: * discovered at `.claude/skills/<skill>/SKILL.md` directly). The wipe removes
L12: * only the items carrying this prefix, leaving the project's own content intact.
L13: * If `<src>/CLAUDE.md` exists, injects a demarcated `@import` into the consumer's
L14: * `.claude/CLAUDE.md`.
L15: *
L16: * ai-extensions/skills/foo/SKILL.md -> .claude/skills/<PREFIX>-foo/SKILL.md
L17: *
...
L19: * During DS-monorepo dev the package lives in packages/ui (outside node_modules),
L20: * so the script is inert and the repo's `.claude/` stays intact.
L21: */
Findings
1 Critical4 High2 Medium5 Low
CriticalAi Agent Control Hijackscripts/setup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/theme.css
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/setup.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ploomescrm/ui@3.9.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @ploomescrm/ui@3.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
10 known versions3.9.1latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 19, 2026, 12:47 PM3.9.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 16, 2026, 4:45 PM3.8.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 9, 2026, 5:15 PM3.7.1SuspiciousAgent extension lifecycle riskWarnPublishedOct 8, 2026, 1:29 PM