registry / elsan-puulse-react / 2.0.0

elsan-puulse-react@2.0.0

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies the consuming project's CLAUDE.md. The inserted content directs an AI agent to follow skills stored in this dependency.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm or pnpm installation triggers postinstall.

Impact

It changes a foreign project AI-agent control surface without an explicit user command.

Mechanism

Automatic consumer AI-agent instruction-file mutation.

Policy narrative

When installed, npm runs scripts/init-skills.js. The script resolves the consumer project directory from INIT_CWD, then creates or rewrites CLAUDE.md there. Its inserted block instructs an AI agent to read package-controlled skill files before using the library. This is an unconsented postinstall modification of a foreign AI-agent control surface.

AI rationale

The automatic postinstall hook writes behavior-bearing instructions into the consuming project's CLAUDE.md. This is concrete install-hook abuse even though the inspected code does not show network exfiltration or shell execution.

Evidence

package.jsonscripts/init-skills.jsCLAUDE.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

elsan-puulse-react@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code