registry / AI-agent control-surface risk / @threenative/core
@threenative/core
The small vanilla Three.js game runtime foundation.
This report shows the evidence for @threenative/core@0.3.4. 3 of 7 known versions are blocked or flagged. The newest version, 0.3.6, is flagged. See all versions.
AI Security Review
scanned 21d ago · by lpm-firewall-aiInspected source establishes unconsented postinstall mutation of a broad, foreign AI-agent control surface, meeting the explicit blocking policy. Package-aligned tools and an opt-out do not supply affirmative consent.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An npm installation that runs postinstall in a consumer project declaring @threenative/core, unless MCP setup is explicitly disabled.
Impact
Agent hosts acquire additional executable tools without an explicit setup decision; subsequent server launches can fetch and execute missing packages through npx.
Mechanism
The lifecycle hook calls MCP setup, which merges server commands into JSON configurations and appends missing Codex server tables.
Policy narrative
The install lifecycle selects the consuming project and automatically registers ThreeNative MCP servers across seven agent hosts. It writes agent configuration without asking for consent, although an environment variable can disable setup. The resulting configurations specify executable server commands. The launcher also supports fetching and executing missing server packages through npx. Project scoping and preservation of existing entries reduce collateral changes but do not authorize broad agent configuration mutation.
AI rationale
Inspected source establishes unconsented postinstall mutation of a broad, foreign AI-agent control surface, meeting the explicit blocking policy. Package-aligned tools and an opt-out do not supply affirmative consent.
Evidence
package.jsonscripts/postinstall.mjsscripts/ensure-mcp.mjsmcp/install.mjsmcp/servers.mjsmcp/launch.mjs.mcp.json.codex/config.toml.cursor/mcp.json.vscode/mcp.json.gemini/settings.jsonopencode.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json automatically runs scripts/postinstall.mjs, which invokes MCP setup.
- scripts/ensure-mcp.mjs configures agent hosts by default; only an environment-variable opt-out prevents setup.
- mcp/install.mjs targets seven agent hosts, including Claude Code, Codex, Cursor, VS Code, and Gemini.
- mcp/install.mjs creates or rewrites agent JSON configuration and appends server definitions to Codex configuration.
- mcp/servers.mjs registers executable MCP commands; mcp/launch.mjs can launch missing server packages through npx without confirmation.
Evidence against
- Setup is limited to consumer projects declaring this package and skips nested dependency directories.
- Existing server definitions are preserved, and malformed JSON configurations are skipped.
- The registered servers are package-aligned; no credential theft was established.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgmcp/launch.mjsView file
•matchType = normalized_sha256
matchedPackage = @threenative/core@0.3.2
matchedPath = mcp/launch.mjs
matchedIdentity = npm:QHRocmVlbmF0aXZlL2NvcmU:0.3.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
mcp/launch.mjsView on unpkgFindings
1 Critical5 High6 Medium6 Low
CriticalAi Agent Control Hijackmcp/install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirgpl/fixtures/make_world_fixture.py
HighSemantic Analysis Limitedmcp/blender-server.mjs#virtual:normalized:round1
HighKnown Malware Source Similaritymcp/launch.mjs
HighPrevious Version Dangerous Deltamcp/blender-server.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiremcp/launch.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpergpl/convert.py
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @threenative/core@0.3.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @threenative/core@0.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions0.3.6latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 21, 2026, 10:13 AM0.3.5SuspiciousAgent extension lifecycle riskWarnPublishedOct 20, 2026, 12:15 AM0.3.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 2, 2026, 9:43 AM0.3.3SuspiciousAgent extension lifecycle riskWarnPublished