registry / AI-agent control-surface risk / plan-ai-brain
plan-ai-brain
Token-efficient project memory, planning and governance for AI coding agents
This report shows the evidence for plan-ai-brain@0.1.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource confirms unconsented postinstall mutation of a broad, foreign AI-agent control surface. Lack of network activity does not mitigate this concrete install-time control injection.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation when INIT_CWD is a consuming project directory
Impact
Persistent control of compatible AI-agent behavior in the host project, plus project ignore-file mutation.
Mechanism
postinstall-driven project AI instruction and configuration injection
Policy narrative
Installing the package executes bin/postinstall.mjs, which resolves INIT_CWD and calls init with --yes. init writes an AGENTS.md runtime contract that directs AI-agent behavior and creates project memory/configuration files, while also modifying Git and Docker ignore files. These mutations occur without an explicit user command and target a broad host-project AI-agent control surface.
AI rationale
Source confirms unconsented postinstall mutation of a broad, foreign AI-agent control surface. Lack of network activity does not mitigate this concrete install-time control injection.
Evidence
package.jsonbin/postinstall.mjslib/cli.mjslib/fs-utils.mjsAGENTS.md.ai-brain/.gitignore.dockerignore
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs postinstall automatically.
- bin/postinstall.mjs calls init against INIT_CWD without consent.
- lib/cli.mjs init writes project-root AGENTS.md.
- The injected AGENTS.md establishes persistent AI-agent behavior rules.
- init also modifies .gitignore and .dockerignore in the host project.
Evidence against
- No network endpoints or exfiltration code found.
- child_process use is limited to explicit privacy --untrack Git index removal.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/cli.mjsView file
10Install-time code directly mutates a foreign AI-agent control surface:
L10: const ADAPTERS = {
L11: codex: ['.agents/skills/project-brain/SKILL.md'],
L12: claude: ['CLAUDE.md', '.claude/skills/project-brain/SKILL.md'],
L13: gemini: ['GEMINI.md', '.gemini/skills/project-brain/SKILL.md'],
...
L49: await ensurePrivacyIgnores(root);
L50: await upsertSection(path.join(root, 'AGENTS.md'), 'plan-ai-runtime-contract', `## Project Brain runtime contract
L51:
...
L95: const model = sanitize(options.model || provider);
L96: const adapterList = ADAPTERS[provider].length ? ADAPTERS[provider].map((file) => `- \`${file}\``).join('\n') : '- Universal `AGENTS.md` only';
L97: const content = `# Active AI adapter\n\n- Provider: ${provider}\n- Model: ${model}\n- Configured: ${new Date().toISOString()}\n\n##
Findings
1 Critical1 High3 Medium4 Low
CriticalAi Agent Control Hijacklib/cli.mjs
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to plan-ai-brain@0.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing plan-ai-brain@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.