registry / copilot-framework / 1.6.0
copilot-framework@1.6.0
Contract-first Copilot scaffolding and workspace bootstrap scripts for Edenred repositories.
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource inspection confirms that an npm postinstall hook automatically changes repository-level Copilot configuration when it detects a repository, without an interactive consent step. The setup is first-party and local, so this supports a warning for agent extension lifecycle risk rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package in a detected repository outside CI or production.
Impact
The install can change instructions and tools available to Copilot in the repository; no credential transfer or remote endpoint was identified in this setup path.
Mechanism
The hook copies package-owned workspace instructions and creates or merges a project MCP configuration that launches this package's local server.
AI rationale
Source inspection confirms that an npm postinstall hook automatically changes repository-level Copilot configuration when it detects a repository, without an interactive consent step. The setup is first-party and local, so this supports a warning for agent extension lifecycle risk rather than a block.
Evidence
package.jsonscripts/postinstall.jsworkspace/.github/AGENTS.mdworkspace/.github/copilot-instructions.mdworkspace/.vscode/mcp.json.github/AGENTS.md.github/copilot-instructions.md.vscode/mcp.json
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs a postinstall hook that starts scripts/postinstall.js.
- The hook skips development, CI, and production installs; in other repository installs it proceeds without an interactive consent step.
- In a detected repository, the hook copies Copilot workspace assets and creates an MCP configuration.
- The MCP configuration is merged with existing settings and written to the repository.
- The generated entry registers this package's local MCP server, making the behavior first-party setup.
Evidence against
- The inspected setup uses a local Node command and preserves existing MCP servers in its merge.
- No credential transfer or remote endpoint was identified in the inspected postinstall path.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
37const timestamp = new Date().toISOString();
L38: fs.mkdirSync(path.dirname(SETUP_TELEMETRY_PATH), { recursive: true });
L39: fs.appendFileSync(
L40: SETUP_TELEMETRY_PATH,
...
L56: function writePackManifest(packName, source, status, reason) {
L57: fs.mkdirSync(KNOWLEDGE_PACK_STATE_DIR, { recursive: true });
L58: const manifest = {
...
L65: };
L66: fs.writeFileSync(KNOWLEDGE_PACK_MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
L67: }
...
L216: '.github/*.md',
L217: '.github/AGENTS.md',
Critical
Findings
1 Critical6 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.js
HighShips High Entropy Blobdocs/feature/product-qa-mcp-context-hub/executive-one-pager-s5-s9-edenred.pdf
HighKnown Malware Source Similaritydist/prompt-eval/provider.js
HighKnown Malware Source Similaritydist/prompt-eval/cache.js
HighPrevious Version Dangerous Deltadist/prompt-eval/provider.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperstacks/agenred-rag-api/cloud/provision-ado-repo.sh
Affected versions and remediation
This report applies to copilot-framework@1.6.0.
See all versions of copilot-framework for other recorded verdicts.
- Review the evidence and your use of copilot-framework@1.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.