Loading npm security reports…

@threenative/core@0.3.0: AI-agent control-surface risk | LPM Firewall

registry / @threenative/core / 0.3.0

@threenative/core@0.3.0

The small vanilla Three.js game runtime foundation.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's MCP and Codex agent configuration. It also writes a patch into the resolved three dependency.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation.

Impact

A dependency install silently registers package-controlled MCP servers for future Codex use and alters third-party dependency files.

Mechanism

Automatic project-level AI-agent configuration injection and dependency patching.

Policy narrative

On installation, the postinstall hook calls MCP setup and a dependency patcher. MCP setup identifies the consumer project, creates or edits .mcp.json, and appends named servers to .codex/config.toml. Those servers execute scripts from this package whenever the configured agent host uses them. This is an unconsented install-time mutation of a foreign project-level AI-agent control surface, compounded by modification of the resolved three dependency.

Rationale

The automatic postinstall hook silently writes consumer project AI-agent configuration and patches a third-party dependency. This meets the policy threshold for malicious install-hook abuse even though no secret exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsmcp/install.mjsscripts/apply-three-patch.mjs.mcp.json.codex/config.tomlnode_modules/three

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

mcp/launch.mjsView file

7* here: `threenative-engine-mcp` publishes an `exports` map with only an `import` condition, which L8: * `createRequire().resolve` refuses, and the answer we want is the directory rather than a L9: * specifier's entry point. Walking `node_modules` upward from both the project and this package

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcp/launch.mjsView on unpkg · L7

mcp/install.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L2: import path from "node:path"; L3: import { mergeMcpServers } from "./servers.mjs"; L4: ... L20: L21: /** Adds the ThreeNative servers to `<target>/.mcp.json`, creating it when absent. Returns what it L22: * did so the installer can say so once and stay quiet otherwise. */ L23: export function ensureMcpConfig(target) { L24: const configPath = path.join(target, ".mcp.json"); L25: let existing; ... L33: } L34: const { changed, config } = mergeMcpServers(existing); Write operation from mcp/install.mjs: L1: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L2: import path from "node:path"; L3: import { mergeMcp

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

mcp/install.mjsView on unpkg · L1