registry / @whoiskaushik/mandate / 0.1.7
@whoiskaushik/mandate@0.1.7
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe automatic install-time agent configuration and proxy startup create an agent extension lifecycle risk. The registered server belongs to this package, and the inspected source does not establish concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its postinstall setup command.
Impact
The package is registered as an agent extension and its proxy runs automatically after installation.
Mechanism
Setup writes the package’s MCP entry to workspace and user configuration, then starts a detached local proxy.
AI rationale
The automatic install-time agent configuration and proxy startup create an agent extension lifecycle risk. The registered server belongs to this package, and the inspected source does not establish concrete malicious behavior.
Evidence
package.jsondist/commands/setup.jsdist/monitor/ports.js.agents/mcp_config.json~/.claude.json
Network endpoints1
127.0.0.1:8000
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically runs the package setup command.
- Setup registers this package’s MCP server in the workspace agent configuration.
- Setup registers this package’s MCP server in the user’s Claude configuration.
- Setup starts a background proxy, which is launched as a detached process.
- The command wrapper sends session metadata to a loopback proxy.
- The MCP server exposes Mandate status and model governance tools.
Evidence against
- The reviewed setup registers this package’s own MCP server; the inspected paths do not establish a separate payload or credential export.
- The session notification goes to the local proxy and contains command and status metadata.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/mandate.js setup
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/mandate.js setup
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/commands/mcp.jsView file
8Install-time code directly mutates a foreign AI-agent control surface:
L8: export async function installMcpServer(options = {}) {
L9: const isClaude = options.claude || (!options.claude && !options.antigravity);
L10: const isAntigravity = options.antigravity || (!options.claude && !options.antigravity);
L11: const binPath = path.resolve(process.cwd(), "node_modules/.bin/mandate");
...
L13: try {
L14: const agentsDir = path.resolve(process.cwd(), ".agents");
L15: if (!fs.existsSync(agentsDir)) {
L16: fs.mkdirSync(agentsDir, { recursive: true });
L17: }
L18: const configPath = path.join(agentsDir, "mcp_config.json");
L19: let currentConfig = { mcpServers: {} };
L20: if (fs.existsSync(configPath)) {
Write operation from dist/config.js:
L58: if (!fs.existsSync(targetDir)) {
L59: fs.mkdirSync(t
Findings
1 Critical5 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/commands/mcp.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/monitor/detector.js
HighKnown Malware Source Similaritydist/monitor/ports.js
HighKnown Malware Source Similaritydist/commands/run.js
HighPrevious Version Dangerous Deltadist/monitor/model-observer.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @whoiskaushik/mandate@0.1.7.
See all versions of @whoiskaushik/mandate for other recorded verdicts.
- Review the evidence and your use of @whoiskaushik/mandate@0.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.