registry / @whoiskaushik/mandate / 0.1.4

@whoiskaushik/mandate@0.1.4

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The automatic install-time agent configuration and background proxy setup create a real agent extension lifecycle risk. The inspected proxy forwards requests to their upstream LLM, and the source reviewed does not establish unrelated data export or broader control hijacking.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through npm invokes its postinstall setup command.

Impact

Agent configuration changes and a background listener may remain after installation; inspected source does not establish external prompt or tool-content export.

Mechanism

Setup writes MCP configuration for the workspace and the user’s global Claude settings, then starts the local proxy on port 8000.

AI rationale

Evidence

package.jsondist/commands/setup.jsdist/commands/run.jsdist/commands/mcp.jsdist/monitor/ports.jsdist/monitor/proxy.js.agents/mcp_config.json~/.claude.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook automatically runs the package setup command.
Setup writes this package’s MCP command into the user’s global Claude configuration and starts a local telemetry proxy.
The proxy inspects agent request bodies and forwards requests to an upstream LLM; the inspected forwarding code does not establish export to an unrelated recipient.

Evidence against

The configured MCP server launches this package’s own command, and the inspected source does not establish prompt or tool-content export to an external recipient.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 96.1 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, mandate-cockpit.vercel.app

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node ./bin/mandate.js setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/mandate.js setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

18"scripts": { "postinstall": "node ./bin/mandate.js setup", "build": "tsc", "dev": "tsx src/index

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the package setup command.

package.jsonView on unpkg · L18

dist/commands/mcp.jsView file

8Install-time code directly mutates a foreign AI-agent control surface: L8: export async function installMcpServer(options = {}) { L9: const isClaude = options.claude || (!options.claude && !options.antigravity); L10: const isAntigravity = options.antigravity || (!options.claude && !options.antigravity); L11: const binPath = path.resolve(process.cwd(), "node_modules/.bin/mandate"); ... L13: try { L14: const agentsDir = path.resolve(process.cwd(), ".agents"); L15: if (!fs.existsSync(agentsDir)) { L16: fs.mkdirSync(agentsDir, { recursive: true }); L17: } L18: const configPath = path.join(agentsDir, "mcp_config.json"); L19: let currentConfig = { mcpServers: {} }; L20: if (fs.existsSync(configPath)) { Write operation from dist/config.js: L58: if (!fs.existsSync(targetDir)) { L59: fs.mkdirSync(t

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/commands/mcp.jsView on unpkg · L8

dist/commands/setup.jsView file

68const localBin = path.resolve(process.cwd(), "packages/cli/bin/mandate.js"); const mcpArgs = fs.existsSync(localBin) ? [localBin, "mcp"] : [path.resolve(__dirname, "../../bin/mandate.js"), "mcp"]; claudeConfig.mcpServers = claudeConfig.

Medium

Ai Review Evidence

Setup writes this package’s MCP command into the user’s global Claude configuration and starts a local telemetry proxy.

dist/commands/setup.jsView on unpkg · L68

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/mandate.js setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/mandate.js setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

18"scripts": { "postinstall": "node ./bin/mandate.js setup", "build": "tsc", "dev": "tsx src/index

Medium

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs the package setup command.

package.jsonView on unpkg · L18

dist/commands/mcp.jsView file

Findings

1 Critical1 High6 Medium4 Low

CriticalAi Agent Control Hijackdist/commands/mcp.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencedist/commands/setup.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @whoiskaushik/mandate@0.1.4.

See all versions of @whoiskaushik/mandate for other recorded verdicts.

Review the evidence and your use of @whoiskaushik/mandate@0.1.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 19:31:36.563Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.