registry / astro-swiper-zosei / 0.14.7

astro-swiper-zosei@0.14.7

Astro component for swiper, dedicated to slider / carousel / photo swiper / slide, including thumbnails

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the consumer project by creating AGENTS/astro-swiper-zosei.md. The dropped file targets several AI coding agents with directive content.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install, pnpm add, or yarn install

Impact

Unconsented mutation of a broad AI-agent control surface in the consumer project.

Mechanism

postinstall writes a consumer AI-agent instruction document

Policy narrative

Installing the package runs scripts/init.cjs. In non-interactive installs it locates the consumer project, creates AGENTS/, and copies a document named astro-swiper-zosei.md. That document presents critical instructions to multiple AI coding assistants, placing package-controlled directives in a project-level agent context without user consent.

Rationale

This is a concrete, automatic postinstall write into a foreign project-level AI-agent control surface. Although no exfiltration or remote execution was found, the lifecycle mutation meets the blocking policy.

Evidence

package.jsonscripts/init.cjsAGENTS/README.mdAGENTS/AGENTS/astro-swiper-zosei.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with false-positive risk.

astro-swiper-zosei@0.14.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code