registry / @ploomescrm/ui / 3.7.1
@ploomescrm/ui@3.7.1
Biblioteca de componentes React do Design System da Ploomes: componentes acessíveis, tematizáveis e prontos para produção, com tokens de design embutidos e suporte a dark mode e whitelabel em tempo de execução.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe automatic postinstall mutation of the consumer’s Claude configuration creates a concrete agent-extension lifecycle risk, even though the inspected extensions contain package-specific UI guidance. The source supports a warning for this first-party setup behavior, not a confirmed malicious attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package as a dependency with its postinstall hook enabled.
Impact
The package’s skills and instructions become available to the consumer’s AI agent after installation.
Mechanism
The script copies extension files into `.claude` directories and synchronizes a package-namespaced import in `.claude/CLAUDE.md` without prompting for consent.
AI rationale
The automatic postinstall mutation of the consumer’s Claude configuration creates a concrete agent-extension lifecycle risk, even though the inspected extensions contain package-specific UI guidance. The source supports a warning for this first-party setup behavior, not a confirmed malicious attack.
Evidence
package.jsonscripts/setup.mjsai-extensions/CLAUDE.mdai-extensions/skills/setup-ploomes-ui/SKILL.mdai-extensions/skills/ui-docs/SKILL.md.claude/skills/.claude/agents/.claude/commands/.claude/output-styles/.claude/CLAUDE.md
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs `node scripts/setup.mjs` during postinstall.
- The setup script targets the consuming project and proceeds for installed dependencies without a user consent prompt.
- It copies package-owned extensions into the consumer’s `.claude` directories and may prepend an import to `.claude/CLAUDE.md`.
- The shipped instructions describe using this package’s UI components and documentation; no malicious instruction was identified in the inspected content.
Evidence against
- The setup limits replacement of existing extension entries to names with the package’s prefix.
- The inspected extension content is package-specific UI setup and documentation guidance.
Behavioral surface
EnvironmentVarsFilesystem
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg78"postinstall": "node scripts/setup.mjs",
"build": "tsdown",
"dev": "tsdown --watch",
"lint": "eslint src --m
Medium
Suspicious Lifecycle Evidence
The manifest runs `node scripts/setup.mjs` during postinstall.
package.jsonView on unpkg · L78scripts/setup.mjsView file
9* Mirrors each category from <src>/ flattened into the root of the consumer's
L10: * `.claude/<category>/`, prefixing each item with the lib name (skills are only
L11: * discovered at `.claude/skills/<skill>/SKILL.md` directly). The wipe removes
L12: * only the items carrying this prefix, leaving the project's own content intact.
L13: * If `<src>/CLAUDE.md` exists, injects a demarcated `@import` into the consumer's
L14: * `.claude/CLAUDE.md`.
L15: *
L16: * ai-extensions/skills/foo/SKILL.md -> .claude/skills/<PREFIX>-foo/SKILL.md
L17: *
...
L19: * During DS-monorepo dev the package lives in packages/ui (outside node_modules),
L20: * so the script is inert and the repo's `.claude/` stays intact.
L21: */
Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/setup.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/theme.css
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Dependency Evidencescripts/setup.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @ploomescrm/ui@3.7.1.
See all versions of @ploomescrm/ui for other recorded verdicts.
- Review the evidence and your use of @ploomescrm/ui@3.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.