registry / AI-agent control-surface risk / @tyroneross/bookmark / 0.3.2

@tyroneross/bookmark@0.3.2

Context snapshots for agent sessions, compactions, and terminal workflows

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The automatic postinstall mutation of global Claude Code settings and instructions creates an unconsented agent control surface. This meets the policy for blocking lifecycle-driven AI-agent control-surface abuse.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with lifecycle scripts enabled, unless CI or BOOKMARK_SKIP_SETUP is set.

Impact

The package gains persistent execution in Claude sessions across projects and changes the agent's global instructions.

Mechanism

Postinstall adds Claude Code hooks to the user's global settings, registers the package, and injects instructions into the global Claude instruction file.

Policy narrative

During npm postinstall, the package automatically registers commands in global Claude Code settings and adds content to the global Claude instruction file. The hooks are configured for session start, stop, compaction, and prompt submission, so they apply across projects. The source provides no affirmative consent prompt for these changes.

AI rationale

Evidence

package.jsondist/setup/auto-setup.jsdist/setup/configure-hooks.js~/.claude/settings.json~/.claude/CLAUDE.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs the setup script automatically from its postinstall hook.
Postinstall setup configures global Claude Code hooks and also modifies a detected project.
The global hook configuration writes into the user's Claude settings and appends package commands for session events.
The automatic setup also injects instructions into the global Claude instruction file.

Evidence against

Setup skips in CI or when BOOKMARK_SKIP_SETUP is true, and the hook merger preserves other hooks.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 151 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 22-62json

22 "dist",

23 "commands",

24 "skills",

25 "hooks",

26 "agents",

27 ".claude-plugin",

28 ".codex-plugin",

29 ".mcp.json",

30 "scripts/install-plugin.sh",

31 "CLAUDE.md",

32 "README.md"

33 ],

34 "scripts": {

35 "build": "tsc && npm run build:fixshebang",

36 "build:fixshebang": "node -e \"const fs=require('fs');const f='dist/cli/index.js';let c=fs.readFileSync(f,'utf8');if(!c.startsWith('#!')){c='#!/usr/bin/env node\\n'+c;fs.writeFileSync(f,c);}\"",

37 "dev": "tsc --watch",

38 "start": "node dist/cli/index.js",

39 "test": "vitest run",

40 "clean": "rm -rf dist",

41 "prepublishOnly": "npm run clean && npm run build",

42 "postinstall": "node dist/setup/auto-setup.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 "install-plugin": "bash scripts/install-plugin.sh --global",

44 "mcp": "node dist/mcp/server.js"

45 },

46 "keywords": [

47 "context",

High

Suspicious Lifecycle Evidence

package.json runs the setup script automatically from its postinstall hook.

package.jsonView on unpkg · L42

48 "snapshots",

49 "session-continuity",

50 "compaction",

51 "memory",

52 "devtools"

53 ],

54 "author": "Tyrone Ross, Jr <46267523+tyroneross@users.noreply.github.com>",

55 "license": "Apache-2.0",

56 "repository": {

57 "type": "git",

58 "url": "git+https://github.com/tyroneross/bookmark.git"

59 },

60 "homepage": "https://github.com/tyroneross/bookmark#readme",

61 "bugs": {

62 "url": "https://github.com/tyroneross/bookmark/issues"

dist/setup/auto-setup.jsView file

Lines 1-21javascript

1import { existsSync, mkdirSync, readFileSync, writeFileSync, realpathSync, symlinkSync, unlinkSync } from 'node:fs';

2import { join, dirname } from 'node:path';

3import { fileURLToPath } from 'node:url';

4import { configureHooks, configureGlobalHooks } from './configure-hooks.js'

dist/cli/index.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ngify({ systemmessage: `bookmark captured ${snapshot.snapshot_id} at ${usedpct}% of the ${usage.model} context window. ` + 'bookmark asked claude to update the handoff. start a new session after this response to restore it.', hookspecificoutput: { hookeventname: 'userpromptsubmit', additionalcontext: `${handoffprompt}\nafter successfully writing it, tell the user to start a new claude session with /clear or by exiting and reopening claude code.`, }, })); } catch { console.log(json.stringify({})); } }); program .command('s

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/index.jsView on unpkg

scripts/install-plugin.shView file

•path = scripts/install-plugin.sh kind = build_helper sizeBytes = 2401 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-plugin.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/setup/auto-setup.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

42"postinstall": "node dist/setup/auto-setup.js || true", "install-plugin": "bash scripts/install-plugin.sh --global", "mcp": "node dist/mcp/server.js" }, "keywords": [

High

Suspicious Lifecycle Evidence

package.json runs the setup script automatically from its postinstall hook.

package.jsonView on unpkg · L42

•scripts.postinstall = node dist/setup/auto-setup.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/setup/auto-setup.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/setup/auto-setup.js

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationdist/cli/index.js

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperscripts/install-plugin.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @tyroneross/bookmark@0.3.2.

See all versions of @tyroneross/bookmark for other recorded verdicts.

Avoid installing @tyroneross/bookmark@0.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-17 03:26:21.698Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @tyroneross

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

More from @tyroneross

Other AI-agent control-surface risk packages