registry / elsan-puulse-react / 2.0.3

elsan-puulse-react@2.0.3

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An installation lifecycle hook modifies an AI-agent instruction file in the consuming project. This is an unconsented mutation of a foreign agent control surface.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package runs the post-install lifecycle hook.

Impact

Future AI-agent sessions in the consumer project can be influenced to load the package's instruction material.

Mechanism

The hook derives the consumer project root and writes or updates its Claude configuration file with package-provided instructions.

Policy narrative

Package installation automatically invokes a script that targets the consuming project's Claude configuration file. The script preserves or replaces a marked section and otherwise appends package-controlled agent instructions. It performs this project-level AI-agent configuration mutation without an explicit user command or consent prompt.

AI rationale

The automatic post-install hook writes to a consumer-owned AI-agent control file, meeting the policy threshold for unconsented lifecycle mutation of a foreign control surface. No additional network or credential behavior is needed for this blocking finding.

Evidence

package.jsonscripts/init-skills.jsCLAUDE.md

Decision evidence

public snapshot

with false-positive risk.

elsan-puulse-react@2.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code