registry / kbglow / 0.2.1

kbglow@0.2.1

Your Mac's keyboard backlight blinks while your AI agent (e.g. Claude Code) is waiting for approval

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates Claude Code's user-level hook configuration without requiring a separate setup command. Installed hooks launch the package binary during agent events.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install, via postinstall

Impact

Persistent execution of package commands in Claude Code event hooks.

Mechanism

postinstall rewrite of Claude Code hook configuration

Policy narrative

The postinstall lifecycle invokes scripts/setup.js, which creates or rewrites ~/.claude/settings.json and adds command hooks that execute bin/kbglow on Claude Code events. This is an unconsented install-time mutation of a foreign AI-agent control surface; the package's stated notification purpose does not remove that control-surface risk.

Rationale

The behavior is transparent and no exfiltration was found, but the package automatically persists execution hooks in Claude Code during installation. This meets the block policy for unconsented postinstall mutation of a foreign AI-agent control surface.

Evidence

package.jsonscripts/setup.jsbin/kbglowREADME.md~/.claude/settings.json~/.claude/settings.json.kbglow-bak/tmp/kbglow.pid

Decision evidence

public snapshot

kbglow@0.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code