@rfdtech/components@2.4.3
Shared React component library for Clet projects
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package’s postinstall automatically invokes setup against the consumer environment, where it writes AI-agent skill files and can modify global Codex configuration. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package when RFDUI_SKIP_SETUP is unset or false-like.
Impact
Installation alters AI-agent instructions and MCP configuration without a separate setup action, creating an unconsented agent control-surface change.
Mechanism
The hook launches the setup CLI in the consumer project; setup writes shared skill files and, for detected tools, changes agent configuration, including the global Codex config.
Policy narrative
During npm installation, the postinstall script invokes the setup CLI in the consumer’s project. Setup writes shared AI-tool skills and configures detected tools; for Codex it adds an MCP server entry to the user’s global config. This is an automatic agent control-surface change.
AI rationale
The package’s postinstall automatically invokes setup against the consumer environment, where it writes AI-agent skill files and can modify global Codex configuration. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Evidence
package.jsonscripts/postinstall.mjsdist/mcp/installers/setup.jsdist/mcp/installers/codex.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 95.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json defines a postinstall hook that runs scripts/postinstall.mjs.
- The postinstall hook launches the setup CLI with the consumer project as its working directory.
- Setup automatically writes shared AI-tool skill files into the consumer project’s .ai directory.
- When Codex is detected, setup adds this package’s MCP server to the user’s global Codex config.
Evidence against
- The setup has an RFDUI_SKIP_SETUP environment opt-out.
- The inspected setup writes package-related skills and MCP configuration; no credential collection or network transmission was identified.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/next-HOLdq4Kk.cjsView file
51contains invisible/control Unicode U+200B (zero width space)
In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function PA(e,t){if(e){if(typeof e==`string`)return FA(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
Findings
2 Critical2 High5 Medium5 Low
CriticalTrojan Source Unicodedist/next-HOLdq4Kk.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/index.css
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/next-HOLdq4Kk.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @rfdtech/components@2.4.3.
See all versions of @rfdtech/components for other recorded verdicts.
- Avoid installing @rfdtech/components@2.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.