registry / cssgraph / 0.3.1

cssgraph@0.3.1

CSS intelligence for AI coding agents — surgical style context, fewer tool calls, faster answers. 100% local.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit installer commands modify AI-agent configuration and instruction files. The Claude target can register a prompt hook and broad cssgraph MCP permission; the Codex target registers a local stdio MCP server.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `cssgraph install` (or provides installer flags).

Impact

Selected agents may launch `cssgraph serve --mcp`; Claude may invoke `cssgraph prompt-hook` on submitted prompts.

Mechanism

First-party AI-agent MCP/configuration setup with optional Claude prompt hook.

Rationale

Source inspection confirms an explicit, first-party AI-agent configuration installer rather than malicious npm lifecycle behavior. Warn because it can alter broad user-level agent configuration and prompt-hook behavior after a user invokes installation.

Evidence

package.jsondist/bin/cssgraph.jsdist/installer/index.jsdist/installer/targets/codex.jsdist/installer/targets/claude.jsdist/installer/targets/shared.js~/.codex/config.toml~/.codex/AGENTS.md~/.claude/settings.json~/.claude/CLAUDE.md

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/bin/cssgraph.js` exposes explicit `install` and `uninstall` commands for AI-agent integration.
`dist/installer/targets/codex.js` writes a `cssgraph` MCP subprocess entry to `~/.codex/config.toml` and inserts instructions into `~/.codex/AGENTS.md`.
`dist/installer/targets/claude.js` can add a `UserPromptSubmit` hook running `cssgraph prompt-hook` and auto-allow `mcp__cssgraph__*`.
`dist/installer/index.js` can run `npm install -g cssgraph`, but only after the interactive installer prompt.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
Installer code is reached only from explicit CLI `cssgraph install`/`uninstall` actions, not package import.
No outbound network API usage or credential/environment exfiltration was found in distributed JavaScript.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 364 KB of source, external domains: docs.claude.com, docs.cursor.com, github.com, google-gemini.github.io, opencode.ai

Source & flagged code

5 flagged

dist/installer/index.jsView file

Lines 32-126javascript

32 var ownKeys = function(o) {

33 ownKeys = Object.getOwnPropertyNames || function (o) {

34 var ar = [];

35 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod && mod.__esModule) return mod;

42 var result = {};

43 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

44 __setModuleDefault(result, mod);

45 return result;

46 };

47})();

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.runInstaller = runInstaller;

50exports.runInstallerWithOptions = runInstallerWithOptions;

51exports.uninstallTargets = uninstallTargets;

52exports.runUninstaller = runUninstaller;

53const child_process_1 = require("child_process");

54const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52

55const fs = __importStar(require("fs"));

56const os = __importStar(require("os"));

57const registry_1 = require("./targets/registry");

58// Dynamic import helper — tsc compiles import() to require() in CJS mode,

59// which fails for ESM-only packages. This bypasses the transformation.

60// eslint-disable-next-line @typescript-eslint/no-implied-eval

61const importESM = new Function('specifier', 'return import(specifier)');

62function getVersion() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60

63 try {

64 const packageJsonPath = path.join(__dirname, '..', '..', 'package.json');

65 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));

66 return packageJson.version;

67 }

68 catch {

69 return '0.1.0';

70 }

71}

72/**

73 * Interactive entry point — preserves the existing UX (`cssgraph

74 * install` with no args goes through the prompts), but now starts

75 * the targets multi-select pre-populated with detected agents.

76 */

77async function runInstaller() {

78 return runInstallerWithOptions({});

79}

80async function runInstallerWithOptions(opts) {

86 // they're committing to before we touch npm or disk.

87 const detectionLocation = opts.location ?? 'global';

88 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

89 if (targets.length === 0) {

90 clack.outro('No agent targets selected — nothing to do.');

91 return;

92 }

93 // Step 2: install the cssgraph npm package on PATH. Skipped when --yes.

94 if (!useDefaults) {

95 const shouldInstallGlobally = await clack.confirm({

96 message: 'Install the cssgraph CLI on your PATH? (Required so agents can launch the MCP server)',

97 initialValue: true,

98 });

99 if (clack.isCancel(shouldInstallGlobally)) {

100 clack.cancel('Installation cancelled.');

101 process.exit(0);

102 }

103 if (shouldInstallGlobally) {

104 const s = clack.spinner();

105 s.start('Installing cssgraph CLI...');

106 try {

107 (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true });

108 s.stop('Installed cssgraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106

109 }

110 catch {

111 s.stop('Could not install (permission denied)');

112 clack.log.warn('Try: sudo npm install -g cssgraph');

113 }

114 }

115 else {

116 clack.log.info('Skipped CLI install — agents will not be able to launch the MCP server without it');

117 }

118 }

119 // Step 3: where the per-agent config files should land.

120 let location;

121 if (opts.location) {

122 location = opts.location;

123 }

124 else if (useDefaults) {

125 location = 'global';

126 }

dist/project-config.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result =

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cssgraph@0.2.5 matchedIdentity = npm:Y3NzZ3JhcGg:0.2.5 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/installer/index.jsView file

52exports.runUninstaller = runUninstaller; L53: const child_process_1 = require("child_process"); L54: const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52

106try { L107: (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true }); L108: s.stop('Installed cssgraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106

60// eslint-disable-next-line @typescript-eslint/no-implied-eval L61: const importESM = new Function('specifier', 'return import(specifier)'); L62: function getVersion() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60

dist/project-config.jsView file

43exports.extractCodeTokens = extractCodeTokens; L44: const path = __importStar(require("path")); L45: const fs = __importStar(require("fs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/project-config.jsView on unpkg · L43

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/installer/index.js

HighShell

HighRuntime Package Installdist/installer/index.js

MediumDynamic Requiredist/project-config.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/installer/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Authororangemust

Maintainersorangemust

Version0.3.2

PublishedJul 13, 2026

LicenseMIT

Dependencies11

Integrityverified

Package size148 KB

Files216

Keywordscssscsslesssasspostcsstailwindcss-in-jsknowledge-graph

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/index.jstypes → dist/index.d.tsbin → cssgraph

Runtimenode >=22.5.0 <25.0.0

Artifact759 KB · 216 files1 signature(s)

Install lifecycleNo install hooks · other: build, clean, cli, copy-assets +3

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

5 flagged

dist/installer/index.jsView file

Lines 32-126javascript

32 var ownKeys = function(o) {

33 ownKeys = Object.getOwnPropertyNames || function (o) {

34 var ar = [];

35 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod && mod.__esModule) return mod;

42 var result = {};

43 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

44 __setModuleDefault(result, mod);

45 return result;

46 };

47})();

48Object.defineProperty(exports, "__esModule", { value: true });

49exports.runInstaller = runInstaller;

50exports.runInstallerWithOptions = runInstallerWithOptions;

51exports.uninstallTargets = uninstallTargets;

52exports.runUninstaller = runUninstaller;

53const child_process_1 = require("child_process");

54const path = __importStar(require("path"));

High

Child Process

Package source references child process execution.

dist/installer/index.jsView on unpkg · L52

55const fs = __importStar(require("fs"));

56const os = __importStar(require("os"));

57const registry_1 = require("./targets/registry");

58// Dynamic import helper — tsc compiles import() to require() in CJS mode,

59// which fails for ESM-only packages. This bypasses the transformation.

60// eslint-disable-next-line @typescript-eslint/no-implied-eval

61const importESM = new Function('specifier', 'return import(specifier)');

62function getVersion() {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/installer/index.jsView on unpkg · L60

63 try {

64 const packageJsonPath = path.join(__dirname, '..', '..', 'package.json');

65 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));

66 return packageJson.version;

67 }

68 catch {

69 return '0.1.0';

70 }

71}

72/**

73 * Interactive entry point — preserves the existing UX (`cssgraph

74 * install` with no args goes through the prompts), but now starts

75 * the targets multi-select pre-populated with detected agents.

76 */

77async function runInstaller() {

78 return runInstallerWithOptions({});

79}

80async function runInstallerWithOptions(opts) {

86 // they're committing to before we touch npm or disk.

87 const detectionLocation = opts.location ?? 'global';

88 const targets = await resolveTargets(clack, opts, detectionLocation, useDefaults);

89 if (targets.length === 0) {

90 clack.outro('No agent targets selected — nothing to do.');

91 return;

92 }

93 // Step 2: install the cssgraph npm package on PATH. Skipped when --yes.

94 if (!useDefaults) {

95 const shouldInstallGlobally = await clack.confirm({

96 message: 'Install the cssgraph CLI on your PATH? (Required so agents can launch the MCP server)',

97 initialValue: true,

98 });

99 if (clack.isCancel(shouldInstallGlobally)) {

100 clack.cancel('Installation cancelled.');

101 process.exit(0);

102 }

103 if (shouldInstallGlobally) {

104 const s = clack.spinner();

105 s.start('Installing cssgraph CLI...');

106 try {

107 (0, child_process_1.execSync)('npm install -g cssgraph', { stdio: 'pipe', windowsHide: true });

108 s.stop('Installed cssgraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/installer/index.jsView on unpkg · L106

109 }

110 catch {

111 s.stop('Could not install (permission denied)');

112 clack.log.warn('Try: sudo npm install -g cssgraph');

113 }

114 }

115 else {

116 clack.log.info('Skipped CLI install — agents will not be able to launch the MCP server without it');

117 }

118 }

119 // Step 3: where the per-agent config files should land.

120 let location;

121 if (opts.location) {

122 location = opts.location;

123 }

124 else if (useDefaults) {

125 location = 'global';

126 }

dist/project-config.jsView file

Lines 23-63javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result =

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg