registry / AI-agent control-surface risk / schematic-pg

schematic-pg

Single-file backend framework for PostgreSQL and Node.js

This report shows the evidence for schematic-pg@0.5.0. 1 of 13 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The package has an active npm postinstall path that unconsentedly overwrites a consumer project's existing AI agent instruction file. This is a concrete AI agent control hijack, so publication should be blocked.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing or updating schematic-pg through npm when INIT_CWD points to a consumer project containing AGENTS.md.

Impact

This can replace project-specific AI agent instructions and change the guidance available to agents working in that project.

Mechanism

The hook resolves INIT_CWD and overwrites AGENTS.md with generated package content without requesting consent.

Policy narrative

During npm postinstall, the package uses INIT_CWD to find the consumer project. If that project already has AGENTS.md, the hook writes the package guide over it without asking first, replacing the project's AI agent instructions.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/cli/postinstall.jsdist/cli/sync-agents.jsdist/cli/templates/agents.md<consumer project>/AGENTS.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.mjs during npm postinstall.
The postinstall script imports and executes the compiled postinstall module.
The hook uses INIT_CWD to locate the consumer project, then replaces its existing AGENTS.md with the package guide without a consent check.
The destination is an AI agent instruction file, and the package guide says it is replaced on install or update.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 149 file(s), 457 KB of source, external domains: cdn.jsdelivr.net

Source & flagged code

6 flagged

package.jsonView file

Lines 31-72json

31 "types": "./dist/index.d.ts",

32 "import": "./dist/index.js"

33 },

34 "./schema-dsl": {

35 "types": "./dist/schema-dsl/index.d.ts",

36 "import": "./dist/schema-dsl/index.js"

37 },

38 "./api/hooks": {

39 "types": "./dist/api/hooks/index.d.ts",

40 "import": "./dist/api/hooks/index.js"

41 },

42 "./api/*": {

43 "types": "./dist/api/*.d.ts",

44 "import": "./dist/api/*.js"

45 },

46 "./db/*": {

47 "types": "./dist/db/*.d.ts",

48 "import": "./dist/db/*.js"

49 }

50 },

51 "scripts": {

52 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L52

53 "build": "tsc -p tsconfig.build.json && mkdir -p dist/cli/templates && cp src/cli/templates/agents.md dist/cli/templates/ && chmod +x dist/cli.js",

High

Suspicious Lifecycle Evidence

package.json runs scripts/postinstall.mjs during npm postinstall.

package.jsonView on unpkg · L51

54 "prepack": "npm run build",

55 "parse": "tsx src/schema-dsl/cli.ts",

56 "tokenize": "tsx src/schema-dsl/cli.ts --tokens",

57 "generate": "tsx src/cli.ts generate",

58 "generate:client": "tsx src/cli.ts generate:client",

59 "generate:api": "tsx src/cli.ts generate:api",

60 "dev:api": "tsx src/cli.ts dev",

61 "start": "tsx src/cli.ts start",

62 "setup:env": "test -f .env || cp .env.example .env",

63 "db:ping": "tsx src/cli.ts db:ping",

64 "db:bootstrap": "tsx src/cli.ts db:bootstrap",

65 "db:push": "tsx src/cli.ts db:push",

66 "db:diff": "tsx src/cli.ts db:diff",

67 "db:migrate": "tsx src/cli.ts db:migrate",

68 "db:migrate:status": "tsx src/cli.ts db:migrate:status",

69 "build:lsp": "npm run build --workspace=@schematic-pg/schema-dsl-language-server",

70 "build:extension": "npm run vscode:prepublish --workspace=schematic-pg-schema-dsl-vscode && npm run package --workspace=schematic-pg-schema-dsl-vscode",

71 "test": "node --import tsx --test $(find src editors/language-server -path '*/__tests__/*.test.ts' ! -name '*.integration.test.ts')",

72 "test:integration": "npm run setup:env && docker compose up -d --wait && npm run generate:client && npm run generate:api && JWT_SECRET=integration-test-secret AUTH_PEPPER=integration-test-pepper node --import tsx --test --test-concurrency=1 'src/**/__tests__/**/*.integration.test.ts'",

dist/constants.jsView file

Lines 1-8javascript

1import { createRequire } from 'node:module';

2const require = createRequire(import.meta.url);

3const { version } = require(

scripts/postinstall.mjsView file

Lines 1-13javascript

1import { existsSync } from 'node:fs';

2import path from 'node:path';

3import { fileURLToPath, pathToFileURL } from 'node:url';

5const packageRoot =

dist/cli/postinstall.jsView file

Lines 1-7javascript

1import { PACKAGE_NAME, PACKAGE_VERSION } from '../constants.js';

2import { syncInstalledAgentsGuide } from './sync-agents.js';

3const result = await syncInstalledAgentsGuide();

4if (result

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

51"scripts": { "postinstall": "node scripts/postinstall.mjs", "build": "tsc -p tsconfig.build.json && mkdir -p dist/cli/templates &&

High

Suspicious Lifecycle Evidence

package.json runs scripts/postinstall.mjs during npm postinstall.

package.jsonView on unpkg · L51

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/constants.jsView file

Findings

4 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencescripts/postinstall.mjs

HighSuspicious Lifecycle Evidencedist/cli/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/constants.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to schematic-pg@0.5.0.

The versions list below shows the verdict for each recorded version.

Avoid installing schematic-pg@0.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 18:34:56.857Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

13 known versions

0.5.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 2, 2026, 10:58 PM 0.4.5Clean—AllowPublishedSep 22, 2026, 11:31 PM 0.4.4Clean—AllowPublishedSep 22, 2026, 5:18 PM 0.4.3Clean—AllowPublishedSep 22, 2026, 3:17 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code