registry / AI-agent control-surface risk / artefact-design-system
artefact-design-system
Артефакт design system — Foundation/Primitives/Components/Sections on top of shadcn/ui + Radix, published as an installable package.
This report shows the evidence for artefact-design-system@0.21.0. 9 of 9 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concrete postinstall write to consumer CLAUDE.md/AGENTS.md, which is a foreign AI-agent control surface. The absence of exfiltration does not mitigate this policy-blocking behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install of artefact-design-system as a dependency
Impact
Hijacks or steers AI-agent behavior in the consuming project.
Mechanism
postinstall writes consumer CLAUDE.md or AGENTS.md
Policy narrative
The npm postinstall hook locates the consumer project via INIT_CWD or cwd and, when installed from node_modules, creates or appends a marked block in CLAUDE.md or AGENTS.md. That block directs AI agents to invoke this package’s CLI and follow its protocol. This is an unconsented install-time mutation of a foreign project’s agent-control surface.
AI rationale
Source inspection confirms a concrete postinstall write to consumer CLAUDE.md/AGENTS.md, which is a foreign AI-agent control surface. The absence of exfiltration does not mitigate this policy-blocking behavior.
Evidence
package.jsonscripts/postinstall.mjsCLAUDE.mdcli/kit.mjsAGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.mjs automatically on install.
- scripts/postinstall.mjs writes or appends an AI-agent instruction block to the consumer project’s CLAUDE.md or AGENTS.md.
- The injected block directs agents to run the package CLI before UI work.
- The write is gated only on installation under node_modules, not explicit user setup.
Evidence against
- No network requests or credential/environment harvesting were found.
- CLI dynamic import is limited to package-local docs; child process use only launches package-local purity.mjs.
- No payload download, shell execution, destructive deletion, or binary loading was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli/kit.mjsView file
64if (!existsSync(file)) return null
L65: return (await import(pathToFileURL(file).href)).docs
L66: }
Medium
Dynamic Require
Package source references dynamic require/import behavior.
cli/kit.mjsView on unpkg · L64Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/postinstall.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirecli/kit.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to artefact-design-system@0.21.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing artefact-design-system@0.21.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
9 known versions0.21.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 28, 2026, 8:56 AM0.15.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 21, 2026, 12:02 PM0.11.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 20, 2026, 8:16 AM0.8.5MaliciousSoft block: AI-agent control surfaceBlock