Loading npm security reports…

ksk-design-system@1.50.0: AI-agent control-surface risk | LPM Firewall

registry / ksk-design-system / 1.50.0

ksk-design-system@1.50.0

KSK Design System — フリーランス向けマルチテーマ対応デザインシステム

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently writes AI-agent instruction files into the consuming project's root. Those generic AGENTS.md and CLAUDE.md files can control subsequent Codex/Claude behavior for that project.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation of the package in a consumer project with INIT_CWD set and no existing root instruction files.

Impact

Unconsented AI-agent control hijack in the consumer project.

Mechanism

postinstall copies package-controlled AI instruction templates to broad project-root agent control surfaces.

Policy narrative

During npm installation, package.json invokes bin/init.js with postinstall. In a consumer project, the script resolves INIT_CWD and silently copies its templates into root-level AGENTS.md and CLAUDE.md unless those files already exist. The templates instruct Codex and Claude to load and follow package-controlled rules, creating an unconsented broad AI-agent control surface.

Rationale

This is a concrete install-time mutation of generic, foreign AI-agent instruction files, which meets the blocking policy regardless of the absence of data exfiltration.

Evidence

package.jsonbin/init.jstemplates/AGENTS.mdtemplates/CLAUDE.md<consumer-project>/AGENTS.md<consumer-project>/CLAUDE.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/init.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/init.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/init.jsView file

5// AI エージェントは node_modules 配下のファイルを自動で読まないため、 L6: // プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS ルールを L7: // 参照する薄いポインタ）を置く必要がある。 ... L9: // Usage: L10: // npx ksk-design-system init # AGENTS.md + CLAUDE.md を設置 L11: // npx ksk-design-system init --force # 既存ファイルを上書き ... L17: L18: import { copyFileSync, existsSync, readdirSync } from "node:fs" L19: import { dirname, join, resolve } from "node:path" ... L228: const files = [ L229: { src: "templates/AGENTS.md", dest: "AGENTS.md", label: "Codex 用" }, L230: { src: "templates/CLAUDE.md", dest: "CLAUDE.md", label: "Claude Code 用" },

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/init.jsView on unpkg · L5

20Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L20: import { fileURLToPath } from "node:url" L21: import { spawnSync } from "node:child_process" L22: L23: const __dirname = dirname(fileURLToPath(import.meta.url)) L24: const pkgRoot = resolve(__dirname, "..") ... L176: "--depth=1", L177: "https://github.com/ekusiek716/ksk-design-system.git", L178: targetDir, ... L214: const isPostinstall = cmd === "postinstall" L215: const consumerRoot = process.env.INIT_CWD || process.cwd() L216: ... L221: }

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/init.jsView on unpkg · L20

•matchType = normalized_sha256 matchedPackage = ksk-design-system@1.49.1 matchedPath = bin/init.js matchedIdentity = npm:a3NrLWRlc2lnbi1zeXN0ZW0:1.49.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/init.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 576e96fcf529515c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = ksk-design-system@1.49.1 matchedPath = bin/init.js matchedIdentity = npm:a3NrLWRlc2lnbi1zeXN0ZW0:1.49.1 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/init.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 154-194json

154 "metrics": "node scripts/download-metrics.mjs",

155 "generate:lookup": "node scripts/generate-component-lookup.mjs",

156 "generate:native-lookup": "node scripts/generate-native-component-lookup.mjs",

157 "generate:safelist": "node scripts/generate-source-safelist.mjs",

158 "lint:safelist": "node scripts/generate-source-safelist.mjs --check",

159 "generate:tokens": "node scripts/generate-platform-tokens.mjs",

160 "lint:tokens": "node scripts/generate-platform-tokens.mjs --check",

161 "lint:token-hex": "node scripts/generate-token-hex-cache.mjs --check",

162 "check:native": "tsc -p tsconfig.native.json --noEmit",

163 "check:native-parity": "node scripts/check-native-parity.mjs",

164 "check:native-lookup": "node scripts/generate-native-component-lookup.mjs --check",

165 "test": "vitest run",

166 "test:consumer:web": "npm run build:lib && node scripts/test-packed-web-consumer.mjs",

167 "test:consumer:native": "npm run build:lib && node scripts/test-packed-native-consumer.mjs",

168 "test:jest-consumer": "node scripts/test-jest-consumer.mjs",

169 "test:watch": "vitest",

170 "test:interaction": "vitest run --config vitest.storybook.config.ts",

171 "test:a11y": "vitest run --config vitest.a11y.config.ts",

172 "check": "tsc -p tsconfig.app.json --noEmit && tsc -p tsconfig.type-tests.json --noEmit && bash scripts/lint-scratch.sh && bash scripts/check-deps.sh && node scripts/check-published-deps.mjs && node scripts/check-css-setup.mjs && bash scripts/check-drift.sh && node scripts/check-screen-contracts.mjs && node scripts/check-docs-drift.mjs && node scripts/check-agents-docs-sync.mjs && node scripts/check-contrast.mjs && node scripts/check-design-md.mjs && node scripts/check-tailwind-v4.mjs && node scripts/check-prefix-order.mjs && node scripts/check-flex-shrink.mjs && bash scripts/check-respons ...

173 "check:agent": "npm run lint && npm run check && npm test && npm run lint:story-reuse",

174 "postinstall": "node bin/init.js postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L174

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L174

175 "version": "node scripts/sync-version.mjs",

176 "mcp:build": "cd mcp-server && npm install && npm run build",

177 "mcp:start": "node mcp-server/dist/index.js"

178 },

179 "dependencies": {

180 "@radix-ui/react-slot": "^1.0.0",

181 "class-variance-authority": "^0.7.1",

182 "clsx": "^2.1.1",

183 "iconsax-reactjs": "^0.0.8",

184 "radix-ui": "^1.0.0",

185 "react-day-picker": "^10.0.1",

186 "react-hook-form": "^7.75.0",

187 "tailwind-merge": "^3.5.0",

188 "typescript": "^6.0.3"

189 },

190 "peerDependencies": {

191 "@react-navigation/bottom-tabs": ">=7.0.0",

192 "expo-blur": "*",

193 "expo-glass-effect": "*",

194 "react": "^18.0.0 || ^19.0.0",

Long lines were clipped for display.

bin/init.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2

3// ksk-design-system CLI

4// Consumer プロジェクトに AI (Claude / Codex) 向けルールファイルを設置する。

5// AI エージェントは node_modules 配下のファイルを自動で読まないため、

6// プロジェクトルートに AGENTS.md / CLAUDE.md（node_modules 内の DS ルールを

7// 参照する薄いポインタ）を置く必要がある。

8//

9// Usage:

10// npx ksk-design-system init # AGENTS.md + CLAUDE.md を設置

11// npx ksk-design-system init --force # 既存ファイルを上書き