registry / AI-agent control-surface risk / payloadcms-seo-cli

payloadcms-seo-cli

A PayloadCMS Content SEO CLI Tool for AI LLM Agents to do SEO

This report shows the evidence for payloadcms-seo-cli@0.1.0, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete unconsented postinstall mutation of foreign and broad AI-agent control surfaces, meeting the block boundary. The user-configured Payload REST client does not mitigate the install-time behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation executes `node dist/cli.js setup --silent`.

Impact

Alters foreign project AI-agent control surfaces without an explicit setup command or consent.

Mechanism

silent postinstall mutation of AI-agent rule and instruction files

Policy narrative

On installation, the postinstall invokes setup with --silent. With no target selector, setup writes the package's Cursor rule and Claude skill and merges its AGENTS.md block into the consumer project. Silent mode bypasses the normal differing-file safeguard for copied targets. The injected instruction tells agents to route writes and scans through this package, modifying multiple unrelated AI-agent control surfaces without an explicit user setup action.

AI rationale

Evidence

package.jsondist/cli.jsrules/AGENTS.mdrules/cursor/payloadcms-seo-cli.mdcrules/claude/payloadcms-seo-cli/SKILL.md.cursor/rules/payloadcms-seo-cli.mdc.claude/skills/payloadcms-seo-cli/SKILL.mdAGENTS.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs `setup --silent` automatically at postinstall.
With no target flags, setup selects Cursor, Claude, and AGENTS targets.
Postinstall's `--silent` permits writing differing target files.
Setup writes a shipped instruction block into the consumer AGENTS.md and copies rules into Cursor and Claude control paths.
Shipped AGENTS instructions direct agents to use this CLI for writes and SEO scans instead of Payload MCP.

Evidence against

No install-time network request, child process, dynamic code execution, or credential harvesting was found in the setup CLI.
The REST client uses a user-configured Payload URL and API key during explicit CLI operations.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 240 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 26-69json

26 "jscpd",

27 "aho-corasick",

28 "cursor",

29 "claude",

30 "codex",

31 "agent-skills"

32 ],

33 "main": "./dist/index.js",

34 "module": "./dist/index.js",

35 "types": "./dist/index.d.ts",

36 "bin": {

37 "payloadcms-seo-cli": "./dist/cli.js"

38 },

39 "files": [

40 "dist",

41 "rules"

42 ],

43 "engines": {

44 "node": ">=20"

45 },

46 "scripts": {

47 "build": "tsdown",

48 "prepublishOnly": "npm run build",

49 "postinstall": "node dist/cli.js setup --silent",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "dev": "tsx src/cli.ts",

High

Suspicious Lifecycle Evidence

package.json runs `setup --silent` automatically at postinstall.

package.jsonView on unpkg · L46

51 "start": "node dist/cli.js",

52 "lint": "eslint .",

53 "lint:fix": "eslint . --fix",

54 "scip:index": "scip-typescript index --output tools/scip/index.scip",

55 "scip:stats": "tools/scip/scip stats --from tools/scip/index.scip",

56 "scip:json": "tools/scip/scip print --json tools/scip/index.scip",

57 "scip:convert": "tools/scip/scip expt-convert --output tools/scip/scip.db tools/scip/index.scip",

58 "scip:sqlite": "sqlite3 tools/scip/scip.db",

59 "scip:snapshot": "tools/scip/scip snapshot --from tools/scip/index.scip --to tools/scip/scip-snapshot --strict=false",

60 "ast-grep:scan": "ast-grep scan",

61 "ast-grep:test": "ast-grep test --skip-snapshot-tests",

62 "ast-grep:debug": "ast-grep scan -r tools/ast-grep/rules/typescript/ts-param-trailing-comma.yml",

63 "knip": "knip --config ./knip.json"

64 },

65 "devDependencies": {

66 "@ast-grep/cli": "^0.45.1",

67 "@eslint/eslintrc": "^3.3.0",

68 "@eslint/js": "^10.0.0",

69 "@sourcegraph/scip-typescript": "^0.4.0",

dist/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { a as printCaughtError, d as toUnknownError, f as FILE_UTF8_ENCODING, h as FLAG_HELP, m as FLAG_FORCE, n as PACKAGE_JSON_FILE_NAME, p as FLAG_DRY_RUN, r as PACKAGE_JSON_UTF8_ENCODING, t as runCli } from "./run-cli-BzZqC631.js";

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/cli.js setup --silent

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

46"scripts": { "build": "tsdown", "prepublishOnly": "npm run build", "postinstall": "node dist/cli.js setup --silent", "dev": "tsx src/cli.ts",

High

Suspicious Lifecycle Evidence

package.json runs `setup --silent` automatically at postinstall.

package.jsonView on unpkg · L46

•scripts.postinstall = node dist/cli.js setup --silent

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencedist/cli.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to payloadcms-seo-cli@0.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing payloadcms-seo-cli@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 11:23:59.852Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.1.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 24, 2026, 7:42 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages