registry / @ruelya/grok-build / 1.0.8-rev

@ruelya/grok-build@1.0.8-rev

Grok Build fork. Product version tracks upstream (currently 1.0.8-rev). Thin installer downloads from GitHub Releases.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic installation replaces an existing AI-agent client and changes its updater configuration without confirmation. It also overrides an explicit disabled auto-update setting.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation with postinstall enabled and neither skip condition active.

Impact

The existing agent client and its update behavior become controlled by the fork installation.

Mechanism

The lifecycle hook runs the installer, which installs the fork into .grok, replaces the primary executable, and writes updater settings to config.toml.

Policy narrative

Installing the npm package automatically invokes its installer. The installer targets the existing Grok home, replaces the primary client with the fork, and rewrites updater settings, including overriding a disabled auto-update preference. Backups and optional environment skip flags do not provide consent for this automatic mutation of another vendor's agent control surface.

AI rationale

Source proves unconsented postinstall replacement of a foreign AI-agent client and mutation of its updater configuration. This meets the blocking rule for agent control hijacking despite package-aligned downloads and a restore facility.

Evidence

package.jsonbin/postinstall.mjsbin/platform.mjsbin/install.mjs~/.grok/bin/grok~/.grok/config.tomlfork-install.json

Network endpoints1

/Ruelya/grok-build-rev/releases/download/v1.0.8-rev

@ruelya/grok-build@1.0.8-rev

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code