Loading npm security reports…

@pure-ds/core@0.7.83: AI-agent control-surface risk | LPM Firewall

registry / @pure-ds/core / 0.7.83

@pure-ds/core@0.7.83

Why develop a Design System when you can generate one?

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install mutates the consuming project's VS Code and Cursor MCP configurations and installs agent instruction files. This establishes an AI-agent control surface without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install

Impact

An installed IDE agent can be configured to launch the package MCP server and follow package-supplied instructions.

Mechanism

postinstall writes IDE MCP configuration and agent instructions

Policy narrative

During npm postinstall, the package discovers the consumer root, copies PDS AI instructions, and registers a local Node MCP server in both VS Code and Cursor configuration files. The installed instructions direct agents to query that MCP before writing PDS code. Although the server appears local and no exfiltration was found, this is an unconsented install-time mutation of foreign AI-agent control surfaces.

Rationale

Source confirms an unconsented postinstall mutation of broad third-party AI IDE configuration and instruction surfaces. This meets the install-control-surface blocking policy despite no observed network exfiltration.

Evidence

package.jsonpackages/pds-cli/bin/postinstall.mjspackages/pds-cli/lib/setup-mcp-config.jspackages/pds-cli/bin/pds-mcp-server.jspackages/pds-cli/lib/pds-mcp-core.js.github/copilot-instructions.md.cursorrulespackages/pds-cli/bin/pds-static.js

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node packages/pds-cli/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node packages/pds-cli/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/pds-cli/bin/pds-bootstrap.jsView file

5import path from 'path'; L6: import { spawn } from 'child_process'; L7: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

packages/pds-cli/bin/pds-bootstrap.jsView on unpkg · L5

172stdio: 'inherit', L173: shell: true L174: });

High

Shell

Package source references shell execution.

packages/pds-cli/bin/pds-bootstrap.jsView on unpkg · L172

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.81 matchedPath = packages/pds-cli/bin/pds-bootstrap.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-bootstrap.jsView on unpkg

public/assets/js/pds-auto-definer.jsView file

23const href = spec instanceof URL ? spec.href : new URL(spec, base).href; L24: const mod = await import(href); L25: const Named = mod?.default ?? mod?.[toPascal(tag)];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

public/assets/js/pds-auto-definer.jsView on unpkg · L23

packages/pds-cli/bin/postinstall.mjsView file

234// Create .github directory if it doesn't exist L235: await mkdir(targetDir, { recursive: true }); L236: ... L254: L255: // Also copy .cursorrules for Cursor IDE users L256: try { L257: const cursorSource = path.join(repoRoot, '.cursorrules'); L258: const cursorTarget = path.join(consumerRoot, '.cursorrules'); L259: ... L263: if (!existingCursor.includes('Pure Design System (PDS)')) { L264: console.log('📋 Existing .cursorrules found (not PDS), skipping...'); L265: return;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

packages/pds-cli/bin/postinstall.mjsView on unpkg · L234

packages/pds-cli/bin/generate-manifest.jsView file

261try { L262: execSync(`npx cem analyze --config ${configPath}`, { L263: cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/pds-cli/bin/generate-manifest.jsView on unpkg · L261

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.81 matchedPath = packages/pds-cli/bin/generate-manifest.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/generate-manifest.jsView on unpkg

packages/pds-cli/bin/pds-mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.81 matchedPath = packages/pds-cli/bin/pds-mcp-health.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-health.jsView on unpkg

packages/pds-cli/bin/pds-mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.81 matchedPath = packages/pds-cli/bin/pds-mcp-server.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-server.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 78-118json

78 "src/js/common/",

79 "!src/js/**/*.test.mjs",

80 "src/js/pds-live-manager/",

81 "src/js/pds-core/",

82 "custom-elements.json",

83 "custom-elements-manifest.config.js",

84 "pds.html-data.json",

85 "pds.css-data.json",

86 "LOCALIZATION.md",

87 "readme.md",

88 "INTELLISENSE.md",

89 "CSS-INTELLISENSE-LIMITATION.md",

90 "CSS-INTELLISENSE-QUICK-REF.md"

91 ],

92 "scripts": {

93 "dev": "node esbuild-dev.js",

94 "test": "node --test src/js/common/localization-resource-provider.test.mjs src/js/common/localization.shared-state.test.mjs src/js/common/localization.test.mjs",

95 "prebuild": "npm run types",

96 "build": "node esbuild-build.js",

97 "types": "tsc -p tsconfig.json && node scripts/sync-types.mjs",

98 "postinstall": "node packages/pds-cli/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepds:build": "npm run types",

100 "pds:build": "node packages/pds-cli/bin/pds-static.js",

101 "pds:build-icons": "node packages/pds-cli/bin/pds-build-icons.js",

102 "pds:bootstrap": "node packages/pds-cli/bin/pds-bootstrap.js",

103 "pds:manifest": "node packages/pds-cli/bin/generate-manifest.js",

104 "pds:css-data": "node packages/pds-cli/bin/generate-css-data.js",

105 "pds:import": "node packages/pds-cli/bin/pds-import.js",

106 "pds:dx": "node packages/pds-cli/bin/pds-dx.js",

107 "pds:mcp:server": "node packages/pds-cli/bin/pds-mcp-server.js",

108 "pds:mcp:health": "node packages/pds-cli/bin/pds-mcp-health.js",

109 "pds:mcp:eval": "node packages/pds-cli/bin/pds-mcp-eval.js",

110 "storybook:generate": "cd packages/pds-storybook && npm run generate-stories",

111 "storybook:dev": "cd packages/pds-storybook && npm run storybook:dev",

112 "storybook:build": "cd packages/pds-storybook && npm run storybook:build"

113 },

114 "author": "Marc van Neerven",

115 "license": "ISC",

116 "engines": {

117 "node": ">=18"

118 },

packages/pds-cli/bin/pds-bootstrap.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3import { readFile, writeFile, mkdir, access, rename, rm, copyFile, readdir } from 'fs/promises';

4import { existsSync } from 'fs';

5import path from 'path';

6import

public/assets/js/pds-auto-definer.jsView file

Lines 3-43javascript

3 let opts = {};

4 if (args.length && typeof args[args.length - 1] === "object") {

5 opts =

packages/pds-cli/bin/postinstall.mjsView file

Lines 214-254javascript

214 }

215

216 const defaultConfig = buildStarterPdsConfig();

217

218 await writeFile(configPath, defaultConfig, 'utf8');

219 console.

packages/pds-cli/bin/generate-manifest.jsView file

Lines 241-281javascript

241 const runningFromPostinstall = process.env.PDS_POSTINSTALL === '1';

242

243 if (!analyzerInstalled || runningFromPostinstall) {

244 if (

packages/pds-cli/bin/pds-mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.81 matchedPath = packages/pds-cli/bin/pds-mcp-health.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-health.jsView on unpkg

packages/pds-cli/bin/pds-mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.81 matchedPath = packages/pds-cli/bin/pds-mcp-server.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.81 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-server.jsView on unpkg