registry / AI-agent control-surface risk / @pure-ds/core
@pure-ds/core
Why develop a Design System when you can generate one?
This report shows the evidence for @pure-ds/core@0.7.84. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic postinstall hook mutates foreign project AI-agent configuration and instruction files. This meets the install-time AI-agent control-surface abuse blocking policy despite no observed exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation, through the postinstall lifecycle hook.
Impact
AI coding tools may load package-authored instructions and start the package's local MCP server without an explicit setup command.
Mechanism
Automatic consumer-project mutation and MCP registration.
Policy narrative
On installation, the postinstall hook locates the consumer project, creates configuration, copies package-authored AI instructions, and writes MCP server definitions for VS Code and Cursor. This is automatic rather than an explicit user setup command, so it changes broad AI-agent control surfaces in the consuming project.
AI rationale
The automatic postinstall hook mutates foreign project AI-agent configuration and instruction files. This meets the install-time AI-agent control-surface abuse blocking policy despite no observed exfiltration.
Evidence
package.jsonpackages/pds-cli/bin/postinstall.mjspackages/pds-cli/lib/setup-mcp-config.js.github/copilot-instructions.mdpds.config.js.cursorrules.vscode/mcp.json.cursor/mcp.json.pds-install.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The package registers an automatic postinstall hook.
- Postinstall silently writes AI-agent instruction files and configures MCP integrations in the consumer project.
- The MCP helper writes executable local-server entries into both VS Code and Cursor configuration files.
- The copied instructions direct AI agents to follow a mandatory PDS workflow.
Evidence against
- No credential harvesting or network exfiltration was found in the inspected lifecycle path.
- The configured MCP server uses local stdio rather than a remote endpoint.
- package.json has no runtime dependency on its own package name.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node packages/pds-cli/bin/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node packages/pds-cli/bin/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackages/pds-cli/bin/pds-bootstrap.jsView file
5import path from 'path';
L6: import { spawn } from 'child_process';
L7: import { fileURLToPath } from 'url';
High
Child Process
Package source references child process execution.
packages/pds-cli/bin/pds-bootstrap.jsView on unpkg · L5Findings
1 Critical11 High5 Medium4 Low
CriticalAi Agent Control Hijackpackages/pds-cli/bin/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processpackages/pds-cli/bin/pds-bootstrap.js
HighShellpackages/pds-cli/bin/pds-bootstrap.js
HighEntrypoint Build Divergencepackages/pds-cli/bin/pds-build-icons.js
HighTrigger Reachable External Ai Agent Control Surface Mutationpackages/pds-cli/bin/postinstall.mjs
HighRuntime Package Installpackages/pds-cli/bin/generate-manifest.js
HighSemantic Analysis Limitedpackages/pds-cli/lib/pds-mcp-core.js#virtual:normalized:round1
HighKnown Malware Source Similaritypackages/pds-cli/bin/pds-bootstrap.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @pure-ds/core@0.7.84.
The versions list below shows the verdict for each recorded version.
- Avoid installing @pure-ds/core@0.7.84. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.