Loading npm security reports…

@pure-ds/core@0.7.84: AI-agent control-surface risk | LPM Firewall

registry / @pure-ds/core / 0.7.84

@pure-ds/core@0.7.84

Why develop a Design System when you can generate one?

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's AI-agent control surface. It adds agent instructions and registers a local MCP server for VS Code and Cursor.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

AI coding tools may load package-authored instructions and start the package's local MCP server without an explicit setup command.

Mechanism

Automatic consumer-project mutation and MCP registration.

Policy narrative

On installation, the postinstall hook locates the consumer project, creates configuration, copies package-authored AI instructions, and writes MCP server definitions for VS Code and Cursor. This is automatic rather than an explicit user setup command, so it changes broad AI-agent control surfaces in the consuming project.

Rationale

The automatic postinstall hook mutates foreign project AI-agent configuration and instruction files. This meets the install-time AI-agent control-surface abuse blocking policy despite no observed exfiltration.

Evidence

package.jsonpackages/pds-cli/bin/postinstall.mjspackages/pds-cli/lib/setup-mcp-config.js.github/copilot-instructions.mdpds.config.js.cursorrules.vscode/mcp.json.cursor/mcp.json.pds-install.json

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node packages/pds-cli/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node packages/pds-cli/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/pds-cli/bin/pds-bootstrap.jsView file

5import path from 'path'; L6: import { spawn } from 'child_process'; L7: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

packages/pds-cli/bin/pds-bootstrap.jsView on unpkg · L5

172stdio: 'inherit', L173: shell: true L174: });

High

Shell

Package source references shell execution.

packages/pds-cli/bin/pds-bootstrap.jsView on unpkg · L172

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.83 matchedPath = packages/pds-cli/bin/pds-bootstrap.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-bootstrap.jsView on unpkg

public/assets/js/pds-auto-definer.jsView file

23const href = spec instanceof URL ? spec.href : new URL(spec, base).href; L24: const mod = await import(href); L25: const Named = mod?.default ?? mod?.[toPascal(tag)];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

public/assets/js/pds-auto-definer.jsView on unpkg · L23

packages/pds-cli/bin/pds-build-icons.jsView file

17Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L17: const __filename = fileURLToPath(import.meta.url); L18: const __dirname = path.dirname(__filename); L19: const repoRoot = path.resolve(__dirname, '../../../'); ... L28: }; L29: const shouldLogToStderr = () => process.env.PDS_LOG_STREAM === 'stderr' || process.env.PDS_POSTINSTALL === '1'; L30: const log = (msg, color = 'reset') => { ... L33: if (shouldLogToStderr()) { L34: process.stderr.write(`${text}\n`); L35: } else { ... L52: async function fetchText(url) { L53: const res = await fetch(url); L54: if (!res.ok) throw new Error(`HTTP ${res.status}`);

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

packages/pds-cli/bin/pds-build-icons.jsView on unpkg · L17

packages/pds-cli/bin/postinstall.mjsView file

234// Create .github directory if it doesn't exist L235: await mkdir(targetDir, { recursive: true }); L236: ... L254: L255: // Also copy .cursorrules for Cursor IDE users L256: try { L257: const cursorSource = path.join(repoRoot, '.cursorrules'); L258: const cursorTarget = path.join(consumerRoot, '.cursorrules'); L259: ... L263: if (!existingCursor.includes('Pure Design System (PDS)')) { L264: console.log('📋 Existing .cursorrules found (not PDS), skipping...'); L265: return;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

packages/pds-cli/bin/postinstall.mjsView on unpkg · L234

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. consumerpkg, null, 2) + '\n'); } } catch (e) { console.warn('⚠️ could not ensure pds scripts in consumer package.json:', e.message); } } async function ensurepdsconfig(consumerroot, force = false) { try { const configpath = path.join(consumerroot, 'pds.config.js'); try { await access(configpath); if (!force) { console.log('📝 pds.config.js already exists, skipping...'); return; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

packages/pds-cli/bin/postinstall.mjsView on unpkg

packages/pds-cli/bin/generate-manifest.jsView file

261try { L262: execSync(`npx cem analyze --config ${configPath}`, { L263: cwd: repoRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

packages/pds-cli/bin/generate-manifest.jsView on unpkg · L261

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.83 matchedPath = packages/pds-cli/bin/generate-manifest.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/generate-manifest.jsView on unpkg

packages/pds-cli/lib/pds-mcp-core.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/pds-cli/lib/pds-mcp-core.js#virtual:normalized:round1View on unpkg

packages/pds-cli/bin/pds-mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.83 matchedPath = packages/pds-cli/bin/pds-mcp-health.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-health.jsView on unpkg

packages/pds-cli/bin/pds-mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.83 matchedPath = packages/pds-cli/bin/pds-mcp-server.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-server.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 78-118json

78 "src/js/common/",

79 "!src/js/**/*.test.mjs",

80 "src/js/pds-live-manager/",

81 "src/js/pds-core/",

82 "custom-elements.json",

83 "custom-elements-manifest.config.js",

84 "pds.html-data.json",

85 "pds.css-data.json",

86 "LOCALIZATION.md",

87 "readme.md",

88 "INTELLISENSE.md",

89 "CSS-INTELLISENSE-LIMITATION.md",

90 "CSS-INTELLISENSE-QUICK-REF.md"

91 ],

92 "scripts": {

93 "dev": "node esbuild-dev.js",

94 "test": "node --test src/js/common/localization-resource-provider.test.mjs src/js/common/localization.shared-state.test.mjs src/js/common/localization.test.mjs",

95 "prebuild": "npm run types",

96 "build": "node esbuild-build.js",

97 "types": "tsc -p tsconfig.json && node scripts/sync-types.mjs",

98 "postinstall": "node packages/pds-cli/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L98

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L98

99 "prepds:build": "npm run types",

100 "pds:build": "node packages/pds-cli/bin/pds-static.js",

101 "pds:build-icons": "node packages/pds-cli/bin/pds-build-icons.js",

102 "pds:bootstrap": "node packages/pds-cli/bin/pds-bootstrap.js",

103 "pds:manifest": "node packages/pds-cli/bin/generate-manifest.js",

104 "pds:css-data": "node packages/pds-cli/bin/generate-css-data.js",

105 "pds:import": "node packages/pds-cli/bin/pds-import.js",

106 "pds:dx": "node packages/pds-cli/bin/pds-dx.js",

107 "pds:mcp:server": "node packages/pds-cli/bin/pds-mcp-server.js",

108 "pds:mcp:health": "node packages/pds-cli/bin/pds-mcp-health.js",

109 "pds:mcp:eval": "node packages/pds-cli/bin/pds-mcp-eval.js",

110 "storybook:generate": "cd packages/pds-storybook && npm run generate-stories",

111 "storybook:dev": "cd packages/pds-storybook && npm run storybook:dev",

112 "storybook:build": "cd packages/pds-storybook && npm run storybook:build"

113 },

114 "author": "Marc van Neerven",

115 "license": "ISC",

116 "engines": {

117 "node": ">=18"

118 },

packages/pds-cli/bin/pds-bootstrap.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3import { readFile, writeFile, mkdir, access, rename, rm, copyFile, readdir } from 'fs/promises';

4import { existsSync } from 'fs';

5import path from 'path';

6import

public/assets/js/pds-auto-definer.jsView file

Lines 3-43javascript

3 let opts = {};

4 if (args.length && typeof args[args.length - 1] === "object") {

5 opts =

packages/pds-cli/bin/pds-build-icons.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2

3/**

4 * PDS Build Icons CLI

5 *

6 * Rebuilds the SVG sprite (pds-icons.svg) into the consumer app's configured static root.

7 * Output path: [public.root]/icons/pds-icons.svg

8 *

9 * Usage: node node_modules/@pure-ds/core/packages/pds-cli/bin/pds-build-icons.js

10 */

11

12

packages/pds-cli/bin/postinstall.mjsView file

Lines 214-254javascript

214 }

215

216 const defaultConfig = buildStarterPdsConfig();

217

218 await writeFile(configPath, defaultConfig, 'utf8');

219 console.

packages/pds-cli/bin/generate-manifest.jsView file

Lines 241-281javascript

241 const runningFromPostinstall = process.env.PDS_POSTINSTALL === '1';

242

243 if (!analyzerInstalled || runningFromPostinstall) {

244 if (

packages/pds-cli/lib/pds-mcp-core.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/pds-cli/lib/pds-mcp-core.js#virtual:normalized:round1View on unpkg

packages/pds-cli/bin/pds-mcp-health.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.83 matchedPath = packages/pds-cli/bin/pds-mcp-health.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-health.jsView on unpkg

packages/pds-cli/bin/pds-mcp-server.jsView file

•matchType = normalized_sha256 matchedPackage = @pure-ds/core@0.7.83 matchedPath = packages/pds-cli/bin/pds-mcp-server.js matchedIdentity = npm:QHB1cmUtZHMvY29yZQ:0.7.83 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/pds-cli/bin/pds-mcp-server.jsView on unpkg