registry / AI-agent control-surface risk / ksk-design-system
ksk-design-system
KSK Design System — フリーランス向けマルチテーマ対応デザインシステム
This report shows the evidence for ksk-design-system@1.58.0. 13 of 49 known versions are blocked or flagged. The newest version, 2.20.0, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource inspection confirms the lifecycle hook automatically creates root-level AI-agent instruction files in consumer projects. The no-overwrite guard reduces scope but does not remove the unconsented control-surface mutation on projects lacking those files.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation that executes postinstall in a consumer project with no existing AGENTS.md or CLAUDE.md.
Impact
Unconsented modification of a foreign project’s AI-agent control surface; future agent behavior can be governed by package-controlled instructions.
Mechanism
postinstall copies package-authored AI-agent instruction files into the consumer root.
Policy narrative
Installing the package invokes its postinstall script. In a consumer project, the script selects the consumer root from INIT_CWD, then copies package templates to root-level AGENTS.md and CLAUDE.md if absent. Those files direct AI coding agents to follow package rules and read package-controlled documents. This is an unconsented install-time mutation of a foreign AI-agent control surface.
AI rationale
Source inspection confirms the lifecycle hook automatically creates root-level AI-agent instruction files in consumer projects. The no-overwrite guard reduces scope but does not remove the unconsented control-surface mutation on projects lacking those files.
Evidence
package.jsonbin/init.jstemplates/AGENTS.mdtemplates/CLAUDE.mdAGENTS.mdCLAUDE.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs bin/init.js during npm postinstall.
- The postinstall path targets the consumer project root and copies AGENTS.md and CLAUDE.md there.
- The copied templates instruct Codex/Claude agents to follow package-controlled rules and read package files.
Evidence against
- Existing destination files are skipped unless --force is supplied.
- No credential harvesting, exfiltration, or postinstall network request was found in the inspected path.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/init.js postinstall
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/init.js postinstall
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/init.jsView file
5// AI エージェントは node_modules 配下のファイルを自動で読まないため、
L6: // プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS ルールを
L7: // 参照する薄いポインタ）を置く必要がある。
...
L9: // Usage:
L10: // npx ksk-design-system init # AGENTS.md + CLAUDE.md を設置
L11: // npx ksk-design-system init --force # 既存ファイルを上書き
...
L17:
L18: import { copyFileSync, existsSync, readdirSync } from "node:fs"
L19: import { dirname, join, resolve } from "node:path"
...
L229: const files = [
L230: { src: "templates/AGENTS.md", dest: "AGENTS.md", label: "Codex 用" },
L231: { src: "templates/CLAUDE.md", dest: "CLAUDE.md", label: "Claude Code 用" },
Findings
1 Critical4 High3 Medium4 Low
CriticalAi Agent Control Hijackbin/init.js
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencebin/init.js
HighKnown Malware Source Similaritybin/init.js
HighPrevious Version Dangerous Deltabin/init.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ksk-design-system@1.58.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing ksk-design-system@1.58.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.