registry / AI-agent control-surface risk / @speranto/speranto

@speranto/speranto

A quick and simple machine translation tool for i18n in webapps. Translate JSON, JS/TS, Markdown files and database content using OpenAI, Mistral, or Ollama.

This report shows the evidence for @speranto/speranto@0.4.0. 1 of 4 known versions is blocked or flagged. The newest version, 0.4.3, is flagged. See all versions.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The package performs unconsented postinstall mutation of consumer AI-agent instruction files, directing agents to follow package-provided guidance. This is a concrete AI-agent control-surface change and meets the blocking policy.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package as a direct dependency in a project with a detected project root triggers postinstall.

Impact

Agent tools reading those files are directed to follow package-provided guidance in future work.

Mechanism

The installer calls the agent-docs manager, which adds or replaces a Speranto block in AGENTS.md or CLAUDE.md and writes managed guide files in the consumer project.

Policy narrative

During package installation, the postinstall hook can add a managed Speranto instruction block to the consumer’s AGENTS.md or CLAUDE.md and install a guide under .agents/speranto. This changes AI-agent control instructions without requiring a separate setup command.

AI rationale

Evidence

package.jsonscripts/install-agent-docs.mjsdist/agent-docs.mjsAGENTS.mdCLAUDE.md.claude/CLAUDE.md.agents/speranto/guide.md.agents/speranto/manifest.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs the agent-docs installer from postinstall.
The installer invokes the manager with postinstall enabled for a consumer project that directly depends on the package.
The manager targets consumer AGENTS.md and CLAUDE.md instruction files.
It inserts a managed instruction directing agents to read and follow the package guide, then writes changed instruction files and the guide into the consumer project.

Evidence against

The inserted block is bounded by Speranto-specific markers and its instruction concerns localization and Speranto configuration.
The installer skips the package’s own project and can be disabled with SPERANTO_SKIP_AGENT_DOCS.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 100 KB of source, external domains: api.mistral.ai, api.openai.com

Source & flagged code

5 flagged

package.jsonView file

Lines 16-56json

16 "bin": {

17 "speranto": "dist/index.mjs"

18 },

19 "publishConfig": {

20 "access": "public"

21 },

22 "files": [

23 "dist",

24 "docs/agent-guide.md",

25 "scripts/install-agent-docs.mjs"

26 ],

27 "exports": {

28 ".": {

29 "import": "./dist/index.mjs",

30 "types": "./dist/index.d.mts"

31 }

32 },

33 "scripts": {

34 "types": "tsc src/types.ts --declaration --emitDeclarationOnly --outDir dist",

35 "build": "tsdown",

36 "postinstall": "node ./scripts/install-agent-docs.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 "link": "bun run build && bun link",

38 "sync:version": "bun run scripts/version.ts sync",

39 "bump:version": "bun run scripts/version.ts",

High

Suspicious Lifecycle Evidence

package.json runs the agent-docs installer from postinstall.

package.jsonView on unpkg · L36

40 "bump:patch": "bun run scripts/version.ts patch",

41 "bump:minor": "bun run scripts/version.ts minor",

42 "bump:major": "bun run scripts/version.ts major",

43 "example:seed": "bun run scripts/seed-example-db.ts",

44 "example": "bun run example:seed && cd example_content && bun ../index.ts",

45 "docker:up": "docker compose -p speranto -f tests/docker-compose.yml up -d --wait",

46 "test": "bun run docker:up && LLM_API_KEY=test bun test"

47 },

48 "devDependencies": {

49 "@types/bun": "^1.4.2",

50 "@types/mdast": "^4.0.4",

51 "@types/pg": "^8.23.1",

52 "@types/sql.js": "^1.4.11",

53 "tsdown": "^0.23.0",

54 "typescript": "^7.0.2",

55 "unrun": "^0.3.1"

56 },

dist/index.mjsView file

Lines 1-40javascript

1#!/usr/bin/env bun

2import { manageAgentDocs } from "./agent-docs.mjs";

3import { createRequire } from "node:module";

4import { Command, InvalidArgumentError } from "commander";

5import { createHash } from

dist/agent-docs.mjsView file

Lines 40-80javascript

40function ensureInsideProject(projectRoot, targetPath) {

41 const relativePath = relative(projectRoot, targetPath);

42 if (relativePath === "" ||

scripts/install-agent-docs.mjsView file

Lines 25-65javascript

25 if (parentPath === currentPath) {

26 return undefined

27 }

28 currentPath = parentPath

29 }

30}

32const packageRoot

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-agent-docs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

36"postinstall": "node ./scripts/install-agent-docs.mjs", "link": "bun run build && bun link", "sync:version": "bun run scripts/version.ts sync", "bump:version": "bun run

High

Suspicious Lifecycle Evidence

package.json runs the agent-docs installer from postinstall.

package.jsonView on unpkg · L36

dist/index.mjsView file

20//#region \0rolldown/runtime.js L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))(); L22: //#endregion

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L20

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/agent-docs.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencescripts/install-agent-docs.mjs

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @speranto/speranto@0.4.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @speranto/speranto@0.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-12 11:13:27.164Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.4.3latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 24, 2026, 9:56 AM 0.4.2SuspiciousAgent extension lifecycle riskWarnPublishedSep 23, 2026, 6:35 AM 0.4.0shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 22, 2026, 8:21 AM 0.3.0Clean—AllowPublishedSep 18, 2026, 11:53 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code