registry / AI-agent control-surface risk / @xbg.solutions/bpsk-core
@xbg.solutions/bpsk-core
XBG Frontend Core - Base framework, types, stores, error handling, logging
This report shows the evidence for @xbg.solutions/bpsk-core@2.2.0. 2 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic postinstall mutation of the consumer project's Claude skill directory meets the install-control-surface block policy. The absence of network activity does not neutralize the unconsented overwrite behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation runs postinstall.
Impact
Package-controlled instructions and helper files become available to the consumer's Claude Code environment.
Mechanism
Recursive overwrite of project .claude/skills from the package.
Policy narrative
The package declares a postinstall hook that runs automatically during npm installation. That script uses npm's INIT_CWD to locate the consumer project, then recursively copies the package's .claude/skills tree into the consumer's .claude/skills directory. It overwrites existing files, changing a foreign AI-agent control surface without an explicit setup command. No lifecycle network or shell execution was found, but the automatic broad agent-configuration mutation is concrete install-hook abuse.
AI rationale
The automatic postinstall mutation of the consumer project's Claude skill directory meets the install-control-surface block policy. The absence of network activity does not neutralize the unconsented overwrite behavior.
Evidence
package.jsonscripts/copy-skills.cjs.claude/skills/**
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The npm postinstall hook automatically runs the skill-copying script.
- The script derives the consuming project's root from INIT_CWD and targets its .claude/skills directory.
- The recursive copy overwrites existing consumer skill files, mutating a broad AI-agent control surface without a user command.
Evidence against
- The postinstall script contains no network, shell, or credential-exfiltration behavior.
- The separately shipped Firebase shell helpers are not invoked by the lifecycle hook.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/copy-skills.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/copy-skills.cjsView file
2/**
L3: * postinstall script — copies .claude/skills/ from this package
L4: * into the consuming project's .claude/skills/ directory.
L5: *
...
L29:
L30: const sourceSkills = path.join(__dirname, '..', '.claude', 'skills');
L31: const targetSkills = path.join(projectRoot, '.claude', 'skills');
L32:
...
L42: function copyDirSync(src, dest) {
L43: fs.mkdirSync(dest, { recursive: true });
L44:
...
L51: } else {
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/copy-skills.cjsView on unpkg · L2•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
#!/usr/bin/env node
const fs = require('fs');
const path = require('path');
const projectroot = process.env.init_cwd;
if (!projectroot) {
process.exit(0);
}
const packagejson = path.join(projectroot, 'package.json');
try {
const pkg = json.parse(fs.readfilesync(packagejs
Findings
1 Critical3 High4 Medium6 Low
CriticalAi Agent Control Hijackscripts/copy-skills.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/copy-skills.cjs
HighPayload In Excluded Dir.claude/skills/firebase/cloud-functions/scripts/export_firestore.sh
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helper.claude/skills/firebase/cloud-functions/scripts/export_firestore.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @xbg.solutions/bpsk-core@2.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @xbg.solutions/bpsk-core@2.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.