Loading npm security reports…

@ploomescrm/ui@3.2.0: AI-agent control-surface risk | LPM Firewall

registry / @ploomescrm/ui / 3.2.0

@ploomescrm/ui@3.2.0

Biblioteca de componentes React do Design System da Ploomes: componentes acessíveis, tematizáveis e prontos para produção, com tokens de design embutidos e suporte a dark mode e whitelabel em tempo de execução.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm postinstall, the package mutates the consuming project's Claude Code control surface. It installs package-provided extensions and prepends an import to the project's CLAUDE.md without a user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation as a dependency

Impact

A dependency can activate package-controlled AI-agent instructions and extensions in the consumer project.

Mechanism

postinstall propagation into the consumer .claude configuration

Policy narrative

Installing the package invokes scripts/setup.mjs automatically. When installed beneath node_modules, it uses INIT_CWD as the consumer project root, copies packaged extension categories into that project's .claude directories, and prepends an import to .claude/CLAUDE.md. This is an unconsented install-time write to a foreign AI-agent control surface; the absence of network or credential theft does not remove that control-plane risk.

Rationale

The package performs concrete postinstall mutation of a consuming project's Claude Code configuration and extension directories. This meets the block boundary for unconsented install-time writes to a broad foreign AI-agent control surface.

Evidence

package.jsonscripts/setup.mjsai-extensions/CLAUDE.mdai-extensions/skills/setup-ploomes-ui/SKILL.mdai-extensions/skills/ui-docs/SKILL.mdai-extensions/<projectRoot>/.claude/skills/<projectRoot>/.claude/agents/<projectRoot>/.claude/commands/

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

77"scripts": { "postinstall": "node scripts/setup.mjs", "build": "tsdown",

High

Suspicious Lifecycle Evidence

package.json runs setup.mjs automatically on postinstall.

package.jsonView on unpkg · L77

scripts/setup.mjsView file

9* Mirrors each category from <src>/ flattened into the root of the consumer's L10: * `.claude/<category>/`, prefixing each item with the lib name (skills are only L11: * discovered at `.claude/skills/<skill>/SKILL.md` directly). The wipe removes L12: * only the items carrying this prefix, leaving the project's own content intact. L13: * If `<src>/CLAUDE.md` exists, injects a demarcated `@import` into the consumer's L14: * `.claude/CLAUDE.md`. L15: * L16: * ai-extensions/skills/foo/SKILL.md -> .claude/skills/<PREFIX>-foo/SKILL.md L17: * ... L19: * During DS-monorepo dev the package lives in packages/ui (outside node_modules), L20: * so the script is inert and the repo's `.claude/` stays intact. L21: */

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.mjsView on unpkg · L9

84// In postinstall, INIT_CWD is the directory where the install was triggered (the // consumer project root). In local dev it falls back to the package itself. const projectRoot = process.env.INIT_CWD || process.cwd(); const isInstalledDep = packageRoot.split(sep).includes('node_modules'); if (!isInstalledDep && !process.env.PLOOMES_AI_FORCE) {

High

Suspicious Lifecycle Evidence

The lifecycle script targets the install initiator's project root.

scripts/setup.mjsView on unpkg · L84

103for (const category of CATEGORIES) { const srcDir = join(srcRoot, category); if (!existsSync(srcDir)) continue; const entries = readdirSync(srcDir, { withFileTypes: true }); if (entries.length === 0) continue; const destCategoryDir = join(projectRoot, '.claude', category); // Wipe only this lib's items (by prefix); items removed from the source // disappear on update, and the project's own content is left untouched. if (existsSync(destCategoryDir)) { for (const entry of readdirSync(destCategoryDir, { withFileTypes: true })) { if (isOwned(entry.name)) { rmS

High

Ai Review Evidence

It copies packaged AI skills/agents/commands into the consumer's .claude directory.

scripts/setup.mjsView on unpkg · L103

Lines 64-123javascript

64function upsertBlockAtTop(content, block) {

65 const section = `${BLOCK_BEGIN}\n${block}\n${BLOCK_END}`;

66

67 let rest = content;

68 const begin = content.indexOf(BLOCK_BEGIN);

69 const end = content.indexOf(BLOCK_END);

70 if (begin !== -1 && end !== -1 && end > begin) {

71 const before = content.slice(0, begin).replace(/\s+$/, '');

72 const after = content.slice(end + BLOCK_END.length).replace(/^\s+/, '');

73 rest = before && after ? `${before}\n\n${after}` : `${before}${after}`;

74 }

75 rest = rest.replace(/^\s+|\s+$/g, '');

76

77 return rest ? `${section}\n\n${rest}\n` : `${section}\n`;

78}

79

80function log(msg) {

81 console.log(`[${NAMESPACE}] ${msg}`);

82}

83

84// In postinstall, INIT_CWD is the directory where the install was triggered (the

85// consumer project root). In local dev it falls back to the package itself.

86const projectRoot = process.env.INIT_CWD || process.cwd();

87const isInstalledDep = packageRoot.split(sep).includes('node_modules');

88

89if (!isInstalledDep && !process.env.PLOOMES_AI_FORCE) {

High

Suspicious Lifecycle Evidence

The lifecycle script targets the install initiator's project root.

scripts/setup.mjsView on unpkg · L84

90 log('running outside node_modules (local dev) — nothing to propagate.');

91 process.exit(0);

92}

93

94// Source of the public extensions. PLOOMES_AI_SRC allows pointing elsewhere.

95const srcRoot = process.env.PLOOMES_AI_SRC || join(packageRoot, SRC_DIR);

96if (!existsSync(srcRoot)) {

97 log(`nothing to install: ${SRC_DIR}/ not found.`);

98 process.exit(0);

99}

100

101let installedAny = false;

102

103for (const category of CATEGORIES) {

104 const srcDir = join(srcRoot, category);

105 if (!existsSync(srcDir)) continue;

106

107 const entries = readdirSync(srcDir, { withFileTypes: true });

108 if (entries.length === 0) continue;

109

110 const destCategoryDir = join(projectRoot, '.claude', category);

111

112 // Wipe only this lib's items (by prefix); items removed from the source

113 // disappear on update, and the project's own content is left untouched.

114 if (existsSync(destCategoryDir)) {

High

Ai Review Evidence

It copies packaged AI skills/agents/commands into the consumer's .claude directory.

scripts/setup.mjsView on unpkg · L103

115 for (const entry of readdirSync(destCategoryDir, { withFileTypes: true })) {

116 if (isOwned(entry.name)) {

117 rmSync(join(destCategoryDir, entry.name), {

118 recursive: true,

119 force: true,

120 });

121 }

122 }

123 }