registry / @speranto/speranto / 0.4.2

@speranto/speranto@0.4.2

A quick and simple machine translation tool for i18n in webapps. Translate JSON, JS/TS, Markdown files and database content using OpenAI, Mistral, or Ollama.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The package automatically modifies consumer agent instruction files during postinstall, but the source shows bounded, managed installation of its own translation guide with skip conditions. This fits guarded first-party agent setup and warrants a warning, not a confirmed attack or publish block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package as a direct dependency runs its postinstall hook, unless a skip condition applies.

Impact

Agent behavior can be influenced for Speranto-related work through the added project instructions; no credential transfer or remote execution was identified in the inspected behavior.

Mechanism

The hook installs a bundled guide and inserts a marked instruction directing agents to read it in AGENTS.md or CLAUDE.md.

AI rationale

Evidence

package.jsonscripts/install-agent-docs.mjsdist/agent-docs.mjsdocs/agent-guide.mdAGENTS.mdCLAUDE.md.claude/CLAUDE.md.agents/speranto/guide.md.agents/speranto/manifest.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs an automatic postinstall script that invokes agent-documentation setup.
Postinstall resolves the consumer project and proceeds only when the package is a direct dependency; setup also has explicit skip conditions.
Setup writes a package-managed guide and adds or updates managed instructions in AGENTS.md or CLAUDE.md files.
The installed instruction block directs agents to read the package guide for Speranto-related work.
The guide contains project-specific translation and configuration guidance; the inspected excerpts show no remote instruction channel.

Evidence against

The source confines writes to the project root, checks for symlinks, and manages a marked block while preserving surrounding instruction content.
The installer skips the package's own project and supports environment-variable opt-outs.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

Source & flagged code

5 flagged

package.jsonView file

Lines 17-60json

17 "engines": {

18 "node": ">=22.13"

19 },

20 "bin": {

21 "speranto": "dist/index.mjs"

22 },

23 "publishConfig": {

24 "access": "public"

25 },

26 "files": [

27 "dist",

28 "docs/agent-guide.md",

29 "scripts/install-agent-docs.mjs"

30 ],

31 "exports": {

32 ".": {

33 "import": "./dist/index.mjs",

34 "types": "./dist/index.d.mts"

35 }

36 },

37 "scripts": {

38 "types": "tsc src/types.ts --declaration --emitDeclarationOnly --outDir dist",

39 "build": "tsdown",

40 "postinstall": "node ./scripts/install-agent-docs.mjs",

Medium

Suspicious Lifecycle Evidence

The manifest runs an automatic postinstall script that invokes agent-documentation setup.

package.jsonView on unpkg · L37

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "link": "pnpm build && pnpm link --global",

42 "sync:version": "tsx scripts/version.ts sync",

43 "bump:version": "tsx scripts/version.ts",

44 "bump:patch": "tsx scripts/version.ts patch",

45 "bump:minor": "tsx scripts/version.ts minor",

46 "bump:major": "tsx scripts/version.ts major",

47 "example:seed": "tsx scripts/seed-example-db.ts",

48 "example": "pnpm example:seed && cd example_content && tsx ../index.ts",

49 "docker:up": "docker compose -p speranto -f tests/docker-compose.yml up -d --wait",

50 "test": "pnpm docker:up && LLM_API_KEY=test vitest run",

51 "test:unit": "LLM_API_KEY=test vitest run --exclude tests/database/postgres.test.ts"

52 },

53 "devDependencies": {

54 "@types/node": "^22.0.0",

55 "@types/mdast": "^4.0.4",

56 "@types/pg": "^8.23.1",

57 "@types/sql.js": "^1.4.11",

58 "tsdown": "^0.23.0",

59 "tsx": "^4.20.6",

60 "typescript": "^7.0.2",

dist/index.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { manageAgentDocs } from "./agent-docs.mjs";

3import { createRequire } from "node:module";

4import { Command, InvalidArgumentError } from "commander";

5import { createHash } from

dist/agent-docs.mjsView file

Lines 40-80javascript

40function ensureInsideProject(projectRoot, targetPath) {

41 const relativePath = relative(projectRoot, targetPath);

42 if (relativePath === "" ||

scripts/install-agent-docs.mjsView file

Lines 18-58javascript

18async function findProjectRoot(startPath) {

19 let currentPath = resolve(startPath)

20 while (true) {

21 if (await

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/install-agent-docs.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

37"scripts": { "types": "tsc src/types.ts --declaration --emitDeclarationOnly --outDir dist", "build": "tsdown", "postinstall": "node ./scripts/install-agent-docs.mjs",

Medium

Suspicious Lifecycle Evidence

The manifest runs an automatic postinstall script that invokes agent-documentation setup.

package.jsonView on unpkg · L37

dist/index.mjsView file

20//#region \0rolldown/runtime.js L21: var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))(); L22: //#endregion

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L20

Findings

1 Critical1 High6 Medium4 Low

CriticalAi Agent Control Hijackdist/agent-docs.mjs

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiredist/index.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumSuspicious Lifecycle Evidencescripts/install-agent-docs.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @speranto/speranto@0.4.2.

See all versions of @speranto/speranto for other recorded verdicts.

Review the evidence and your use of @speranto/speranto@0.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 11:13:50.888Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.