registry / AI-agent control-surface risk / @series-inc/stowkit-three-loader
@series-inc/stowkit-three-loader
Three.js loader for StowKit asset packs
This report shows the evidence for @series-inc/stowkit-three-loader@0.1.53, the only known version.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook performs unconsented project-level AI configuration changes, including a Cursor rule marked to always apply. This meets the policy for lifecycle mutation of a broad AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm when it is located in node_modules.
Impact
The added Cursor rule can influence AI assistant behavior throughout the project whenever the rule applies.
Mechanism
The hook uses the install project root to copy a Claude skill and create a Cursor rule from the package skill, without a consent check.
Policy narrative
During npm installation, the postinstall hook writes package-provided instructions into the consumer project’s Claude and Cursor configuration. The Cursor rule is marked to always apply and is installed without a consent check, creating an automatically active project-level AI control surface.
AI rationale
The postinstall hook performs unconsented project-level AI configuration changes, including a Cursor rule marked to always apply. This meets the policy for lifecycle mutation of a broad AI-agent control surface.
Evidence
package.jsonscripts/postinstall.cjsskill.md.claude/skills/stowkit-threejs/SKILL.md.cursor/rules/stowkit-threejs.mdc
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 91.0% confidence with low false-positive risk.
Evidence for policy risk
- The manifest runs scripts/postinstall.cjs after installation.
- The hook runs when installed under node_modules and uses INIT_CWD as the project root; its activation has no agent-configuration consent check.
- The hook copies the package skill into the project’s Claude skills directory.
- It generates a Cursor rule marked to always apply, using the package skill content, and writes it into the project’s .cursor/rules directory.
Evidence against
- The copied skill gives package-specific Three.js loader guidance, which is consistent with the package’s stated purpose.
- The hook also copies the package’s decoder assets into the project’s public directory.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpublic/basis/basis_transcoder.jsView file
8L9: var Module=typeof BASIS!=="undefined"?BASIS:{};var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise(function(resolve,reject){readyPromiseResolve=resolve;readyProm...
L10:
Low
Eval
Package source references a known benign dynamic code generation pattern.
public/basis/basis_transcoder.jsFindings
1 Critical2 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulepublic/draco/draco_decoder.wasm
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalpublic/basis/basis_transcoder.js
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @series-inc/stowkit-three-loader@0.1.53.
The versions list below shows the verdict for each recorded version.
- Avoid installing @series-inc/stowkit-three-loader@0.1.53. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.