elsan-puulse-react@2.2.0
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest activates a script that modifies the consumer project's CLAUDE.md during installation, with no affirmative setup guard. Although the inserted text is package usage guidance, the automatic mutation of a foreign agent control file supports blocking under the lifecycle control-surface policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package with lifecycle scripts enabled triggers postinstall.
Impact
The package alters a foreign AI-agent control file during installation, changing instructions used by the consumer's agent.
Mechanism
The script resolves the consumer project root, then appends a marked section to CLAUDE.md or replaces the existing marked section. The section directs the agent to read the package's skills.
Policy narrative
On installation, postinstall runs scripts/init-skills.js against the consumer project root. Unless installing the package itself, the script appends or replaces a marked section in CLAUDE.md that directs the agent to read package-authored skills. This is an unconsented lifecycle mutation of a consumer AI-agent control surface.
AI rationale
The manifest activates a script that modifies the consumer project's CLAUDE.md during installation, with no affirmative setup guard. Although the inserted text is package usage guidance, the automatic mutation of a foreign agent control file supports blocking under the lifecycle control-surface policy.
Evidence
package.jsonscripts/init-skills.jsCLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 91.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/init-skills.js automatically through postinstall.
- The script targets the installing project's CLAUDE.md and skips only when the project root is the package itself.
- The script appends or replaces a marked section in CLAUDE.md during installation.
- That section directs the AI agent to read this package's skills before using its components, hooks, or utilities.
Evidence against
- The inserted section describes package usage guidance and points to skills shipped with the package.
- The script does not contact a network endpoint.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/init-skills.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg128"postinstall": "node scripts/init-skills.js"
}
}
High
Suspicious Lifecycle Evidence
package.json runs scripts/init-skills.js automatically through postinstall.
package.jsonView on unpkg · L128scripts/init-skills.jsView file
2import {
L3: appendFileSync,
L4: existsSync,
L5: readFileSync,
L6: writeFileSync,
L7: } from "node:fs";
...
L27:
L28: **Lire \`node_modules/elsan-puulse-react/.agents/skills/SKILL.md\` avant tout usage de composant, hook ou utilitaire de cette librairie.** Ce fichier contient les règles globales, ...
L29:
L30: Les skills sont organisées dans \`node_modules/elsan-puulse-react/.agents/skills/\` :
L31: - \`SKILL.md\` — règles globales et index complet (lire en premier)
...
L39:
Critical
Findings
1 Critical3 High3 Medium5 Low
CriticalAi Agent Control Hijackscripts/init-skills.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/init-skills.js
HighSuspicious Lifecycle Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to elsan-puulse-react@2.2.0.
See all versions of elsan-puulse-react for other recorded verdicts.
- Avoid installing elsan-puulse-react@2.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.