registry / @whoiskaushik/mandate / 0.1.3
@whoiskaushik/mandate@0.1.3
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe automatic install hook mutates agent configuration and starts a permissive proxy, leaving a concrete agent-extension lifecycle risk. The inspected proxy forwards requests to the selected LLM service, so the source does not establish publisher-directed prompt exfiltration or justify a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package runs its postinstall setup command.
Impact
Agent configuration changes without a separate setup command, and a browser-accessible proxy remains available. The inspected path does not establish prompt export to a Mandate-controlled recipient.
Mechanism
Setup writes Antigravity workspace and Claude user configuration, then starts the proxy. The proxy allows wildcard origins and private-network access while forwarding requests to Anthropic or OpenAI.
AI rationale
The automatic install hook mutates agent configuration and starts a permissive proxy, leaving a concrete agent-extension lifecycle risk. The inspected proxy forwards requests to the selected LLM service, so the source does not establish publisher-directed prompt exfiltration or justify a block.
Evidence
package.jsondist/commands/setup.jsdist/monitor/ports.jsdist/monitor/proxy.js.agents/mcp_config.json~/.claude.json
Network endpoints3
127.0.0.1:8000api.anthropic.comapi.openai.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically runs the package setup command.
- Setup writes Mandate MCP entries to the Antigravity workspace and the user’s Claude configuration.
- Setup starts a background proxy; its process is detached.
- The proxy permits cross-origin requests and private-network access.
- The proxy selects Anthropic or OpenAI as the upstream and forwards requests there.
Evidence against
- The inspected proxy path forwards requests to the selected LLM service; it does not show prompt uploads to a Mandate-controlled endpoint.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/mandate.js setup
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/mandate.js setup
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg18"scripts": {
"postinstall": "node ./bin/mandate.js setup",
"build": "tsc",
"dev":
Medium
Suspicious Lifecycle Evidence
The postinstall hook automatically runs the package setup command.
package.jsonView on unpkg · L18dist/commands/mcp.jsView file
Findings
1 Critical1 High6 Medium4 Low
CriticalAi Agent Control Hijackdist/commands/mcp.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/commands/setup.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @whoiskaushik/mandate@0.1.3.
See all versions of @whoiskaushik/mandate for other recorded verdicts.
- Review the evidence and your use of @whoiskaushik/mandate@0.1.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.