registry / @ploomescrm/ui / 3.3.0
@ploomescrm/ui@3.3.0
Biblioteca de componentes React do Design System da Ploomes: componentes acessíveis, tematizáveis e prontos para produção, com tokens de design embutidos e suporte a dark mode e whitelabel em tempo de execução.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package automatically installs first-party Claude extensions through a postinstall hook, creating an agent configuration lifecycle risk. The source shows namespaced writes and UI integration guidance, with no verified attack behavior supporting a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package as a dependency triggers postinstall.
Impact
The extensions can influence later Claude Code sessions after activation; no credential transfer or remote behavior was identified in the inspected setup source.
Mechanism
The script copies package extensions into namespaced .claude category folders and adds a marked import to .claude/CLAUDE.md when the package supplies that file.
AI rationale
The package automatically installs first-party Claude extensions through a postinstall hook, creating an agent configuration lifecycle risk. The source shows namespaced writes and UI integration guidance, with no verified attack behavior supporting a block.
Evidence
package.jsonscripts/setup.mjsai-extensions/CLAUDE.md.claude/CLAUDE.md.claude/skills/
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs scripts/setup.mjs automatically during postinstall.
- The setup script targets the consuming project’s .claude configuration and copies extensions into category folders; it removes only entries with this package’s prefix.
- When the package provides a Claude.md file, setup adds a marked import to the consumer’s .claude/CLAUDE.md. The shipped guidance covers using and configuring this UI package.
- The automatic first-party agent configuration setup has no user consent gate, so it presents a residual lifecycle risk.
Evidence against
- The installer scopes copied entries by package prefix and preserves other project content.
- The inspected shipped Claude guidance describes UI package integration and documentation.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg78"postinstall": "node scripts/setup.mjs",
"build": "tsdown",
"dev": "tsdown --watch",
"lint": "eslint src --max-warnings 0",
"type-check": "tsc --noEmit",
"test": "vitest run",
"test:watch": "vitest",
"test:coverage": "vitest run --coverage"
}
}
Medium
Suspicious Lifecycle Evidence
The manifest runs scripts/setup.mjs automatically during postinstall.
package.jsonView on unpkg · L78scripts/setup.mjsView file
9* Mirrors each category from <src>/ flattened into the root of the consumer's
L10: * `.claude/<category>/`, prefixing each item with the lib name (skills are only
L11: * discovered at `.claude/skills/<skill>/SKILL.md` directly). The wipe removes
L12: * only the items carrying this prefix, leaving the project's own content intact.
L13: * If `<src>/CLAUDE.md` exists, injects a demarcated `@import` into the consumer's
L14: * `.claude/CLAUDE.md`.
L15: *
L16: * ai-extensions/skills/foo/SKILL.md -> .claude/skills/<PREFIX>-foo/SKILL.md
L17: *
...
L19: * During DS-monorepo dev the package lives in packages/ui (outside node_modules),
L20: * so the script is inert and the repo's `.claude/` stays intact.
L21: */
Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/setup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/theme.css
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencescripts/setup.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ploomescrm/ui@3.3.0.
See all versions of @ploomescrm/ui for other recorded verdicts.
- Review the evidence and your use of @ploomescrm/ui@3.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.