Loading npm security reports…

domain-driver@0.3.1: AI-agent control-surface risk | LPM Firewall

registry / domain-driver / 0.3.1

domain-driver@0.3.1

CLI scaffolding tool for domain-driven feature folders in Next.js, React, Node, and NestJS projects, with per-action files, bespoke actions, and agent guidance

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies AI-agent instruction and skill files in the consuming project. This is a foreign, broad AI-agent control-surface mutation without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of domain-driver in a non-CI consumer project

Impact

Future AI-agent sessions may follow package-authored instructions from AGENTS.md, CLAUDE.md, and the installed Claude skill.

Mechanism

postinstall writes agent guidance and a Claude skill into the consumer root

Policy narrative

The automatic postinstall hook runs in the consumer project, derives the consumer root from INIT_CWD, and calls initialization. That initialization writes or updates AGENTS.md and CLAUDE.md and creates a Claude skill beneath .claude/skills. These files establish persistent package-authored instructions for broad AI-agent control surfaces without requiring the user to run the init command.

AI rationale

The package performs unconsented postinstall mutation of foreign AI-agent instruction files. This meets the install-control-surface blocking policy even though no exfiltration was found.

Evidence

package.jsonscripts/postinstall.jsdist/postinstall.jsdist/init/init.jsdist/init/content.jsAGENTS.mdCLAUDE.md.claude/skills/domain-driver/SKILL.md

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

17"scripts": { "build": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\" && tsc", "test": "vitest run", "test:coverage": "vitest run --coverage", "postinstall": "node ./scripts/postinstall.js" }

High

Suspicious Lifecycle Evidence

The package registers an automatic postinstall hook.

package.jsonView on unpkg · L17

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/init/init.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L41: const markers_1 = require("./markers"); L42: const SKILL_FILE = '.claude/skills/domain-driver/SKILL.md'; L43: function runInit(root) { L44: return [writeSection(root, 'AGENTS.md'), writeSection(root, 'CLAUDE.md'), writeSkill(root)]; L45: } ... L47: const filePath = path.join(root, file); L48: const result = (0, markers_1.applySection)((0, fs_1.readTextFile)(filePath), content_1.AGENTS_SECTION); L49: if (result.status !== 'unchanged') Write operation from dist/utils/fs.js: L43: try { L44: fs.writeFileSync(filePath, content); L45: } ... L52: try { L53: fs.mkdirSync(dirPath, { recursive: true }); L54: } Foreign user/project scope from dist/postinstall.js: L1: "use strict"; L2: var __createBinding = (this && this.__cre

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/init/init.jsView on unpkg · L1

scripts/postinstall.jsView file

1// Runs after `npm install` in a consuming project. Never fails the install: // dist/ may be absent on a fresh clone, and init may throw for any reason. try { require('../dist/postinstall.js').run(); } catch (_error) { // intentionally silent }

High

Suspicious Lifecycle Evidence

The postinstall launcher invokes its bundled code and suppresses errors.

scripts/postinstall.jsView on unpkg · L1