registry / AI-agent control-surface risk / @uidxkit/uidx

@uidxkit/uidx

Project-local, file-first UI design workspace

This report shows the evidence for @uidxkit/uidx@0.1.5. 1 of 4 known versions is blocked or flagged. The newest version, 0.1.6, is flagged. See all versions.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The manifest activates a postinstall hook that modifies the consumer project's MCP configuration without affirmative consent, registering a command that launches this package. This is unconsented install-time mutation of an AI-agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package locally with npm in a project containing package.json.

Impact

Project agent tools may launch this package's MCP server based on the modified configuration.

Mechanism

postinstall calls initProject, which adds a uidx command entry to the project-root .mcp.json and writes the updated configuration without a consent prompt.

Policy narrative

A local npm install triggers postinstall, which runs project initialization. That initializer adds a uidx MCP server command to the project's .mcp.json without prompting, creating an agent control surface automatically.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/chunk-KDHYTQEB.js.mcp.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs scripts/postinstall.mjs during installation.
The postinstall hook calls initProject for the containing local project without a consent prompt.
Setup reads or creates the project-root .mcp.json file.
Setup adds a uidx MCP server that runs the package's uidx:mcp script, then writes the configuration.
The install hook also installs first-party skills into project agent directories.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 47.9 KB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 95-133json

95 "typescript": "^5.7.2",

96 "vitest": "^5.0.0"

97 },

98 "description": "Project-local, file-first UI design workspace",

99 "engines": {

100 "node": ">=22.19"

101 },

102 "license": "MIT",

103 "publishConfig": {

104 "access": "public"

105 },

106 "repository": {

107 "type": "git",

108 "url": "git+https://github.com/uidxkit/uidx.git",

109 "directory": "packages/cli"

110 },

111 "homepage": "https://github.com/uidxkit/uidx#readme",

112 "bugs": {

113 "url": "https://github.com/uidxkit/uidx/issues"

114 },

115 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L115

116 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L116

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L116

117 "build": "tsup && tsc -p tsconfig.build.json",

118 "test": "vitest run --maxWorkers=2 --testTimeout=20000",

119 "typecheck": "tsc --noEmit"

120 },

121 "bundledDependencies": [

122 "@uidx/format",

123 "@uidx/schema",

124 "@uidx/server",

125 "@uidx/agent",

126 "@uidx/viewer",

127 "@open-pencil/core",

128 "@open-pencil/scene-graph",

129 "image-size",

130 "pptxgenjs"

131 ]

132}

133

node_modules/@uidx/agent/dist/core/eval.jsView file

Lines 73-97javascript

73 const raw = runInNewContext(`(() => { ${script}\n })()`, sandbox, {

74 timeout: TIMEOUT_MS,

75 // A script is one expression of intent; requiring code generation

76 // (eval/new Function inside the sandbox) has no honest use here.

dist/chunk-KDHYTQEB.jsView file

Lines 405-445javascript

405 return await exists(resolve(content, "uidx.json")) ? content : null;

406}

407async function readPackage(root) {

node_modules/@uidx/viewer/dist/assets/index-B3DawXGA.jsView file

99contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

node_modules/@uidx/viewer/dist/assets/index-B3DawXGA.jsView on unpkg · L99

node_modules/@uidx/viewer/dist/canvaskit.wasmView file

•path = node_modules/@uidx/viewer/dist/canvaskit.wasm kind = wasm_module sizeBytes = 7094511 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@uidx/viewer/dist/canvaskit.wasmView on unpkg

node_modules/@uidx/agent/dist/edit/missing-glyphs.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@uidx/agent/dist/edit/missing-glyphs.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: https

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

node_modules/@uidx/agent/dist/core/eval.jsView file

Findings

2 Critical4 High5 Medium3 Low

CriticalAi Agent Control Hijackdist/chunk-KDHYTQEB.js

CriticalTrojan Source Unicodenode_modules/@uidx/viewer/dist/assets/index-B3DawXGA.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/chunk-KDHYTQEB.js

HighNode Builtin Dependency Squatpackage.json

HighSemantic Analysis Limitednode_modules/@uidx/agent/dist/edit/missing-glyphs.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumUnsafe Vm Contextnode_modules/@uidx/agent/dist/core/eval.js

MediumEnvironment Vars

MediumShips Wasm Modulenode_modules/@uidx/viewer/dist/canvaskit.wasm

Affected versions and remediation

This report applies to @uidxkit/uidx@0.1.5.

The versions list below shows the verdict for each recorded version.

Avoid installing @uidxkit/uidx@0.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-17 02:49:31.837Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

0.1.6latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 25, 2026, 11:18 AM 0.1.5shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 19, 2026, 11:38 PM 0.1.4SuspiciousAgent extension lifecycle riskWarnPublishedSep 17, 2026, 5:39 AM 0.1.1SuspiciousAgent extension lifecycle riskWarnPublishedSep 12, 2026, 9:00 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages