@speranto/speranto@0.4.0
A quick and simple machine translation tool for i18n in webapps. Translate JSON, JS/TS, Markdown files and database content using OpenAI, Mistral, or Ollama.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe package performs unconsented postinstall mutation of consumer AI-agent instruction files, directing agents to follow package-provided guidance. This is a concrete AI-agent control-surface change and meets the blocking policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package as a direct dependency in a project with a detected project root triggers postinstall.
Impact
Agent tools reading those files are directed to follow package-provided guidance in future work.
Mechanism
The installer calls the agent-docs manager, which adds or replaces a Speranto block in AGENTS.md or CLAUDE.md and writes managed guide files in the consumer project.
Policy narrative
During package installation, the postinstall hook can add a managed Speranto instruction block to the consumer’s AGENTS.md or CLAUDE.md and install a guide under .agents/speranto. This changes AI-agent control instructions without requiring a separate setup command.
AI rationale
The package performs unconsented postinstall mutation of consumer AI-agent instruction files, directing agents to follow package-provided guidance. This is a concrete AI-agent control-surface change and meets the blocking policy.
Evidence
package.jsonscripts/install-agent-docs.mjsdist/agent-docs.mjsAGENTS.mdCLAUDE.md.claude/CLAUDE.md.agents/speranto/guide.md.agents/speranto/manifest.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs the agent-docs installer from postinstall.
- The installer invokes the manager with postinstall enabled for a consumer project that directly depends on the package.
- The manager targets consumer AGENTS.md and CLAUDE.md instruction files.
- It inserts a managed instruction directing agents to read and follow the package guide, then writes changed instruction files and the guide into the consumer project.
Evidence against
- The inserted block is bounded by Speranto-specific markers and its instruction concerns localization and Speranto configuration.
- The installer skips the package’s own project and can be disabled with SPERANTO_SKIP_AGENT_DOCS.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/install-agent-docs.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg36"postinstall": "node ./scripts/install-agent-docs.mjs",
"link": "bun run build && bun link",
"sync:version": "bun run scripts/version.ts sync",
"bump:version": "bun run
High
Suspicious Lifecycle Evidence
package.json runs the agent-docs installer from postinstall.
package.jsonView on unpkg · L36dist/index.mjsView file
20//#region \0rolldown/runtime.js
L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
L22: //#endregion
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.mjsView on unpkg · L20Findings
1 Critical3 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/agent-docs.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencescripts/install-agent-docs.mjs
MediumDynamic Requiredist/index.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @speranto/speranto@0.4.0.
See all versions of @speranto/speranto for other recorded verdicts.
- Avoid installing @speranto/speranto@0.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.