Loading npm security reports…

silt-design-mode@0.1.18: AI-agent control-surface risk | LPM Firewall

registry / silt-design-mode / 0.1.18

silt-design-mode@0.1.18

Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's AI-agent instruction surface. It adds an AGENTS.md block and may create Claude skill files without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

A dependency can steer coding agents in the consumer project toward the package's Silt tools and workflow.

Mechanism

Automatic injection of project-scoped AI-agent instructions.

Policy narrative

On installation, the lifecycle hook obtains the consumer directory from INIT_CWD and invokes the installer. That installer writes a managed block into the project's AGENTS.md before checking which agent is in use. If no local agent directory exists but the machine has a Claude configuration directory, it creates Claude skill files in the project. The injected block tells agents to use Silt MCP tools, modifying a foreign project’s agent control surface without an explicit user setup action.

AI rationale

This is an unconsented postinstall mutation of a consumer project's broad AI-agent control surface. The safeguards against clobbering do not remove the automatic control-surface write.

Evidence

package.jsonbin/footprint/postinstall.mjsbin/footprint/agent-files.mjsskill/AGENTS-BLOCK.mdAGENTS.md.claude/skills/silt-design-mode/SKILL.md.claude/skills/silt-setup/SKILL.md.claude/skills/silt/SKILL.md

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/footprint/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/footprint/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.mjsView file

42Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L42: */ L43: import { execFileSync, spawn } from 'node:child_process'; L44: import { randomUUID } from 'node:crypto'; L45: import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'; L46: import { createServer } from 'node:http'; L47: import { join, resolve } from 'node:path'; ... L64: * that port and fail if it is taken; a stated port is a decision, not a hint. */ L65: const EXPLICIT_PORT = process.env.DM_PORT ?? argOf('--port'); L66: const HOST = '127.0.0.1'; // loopback only — this must never listen on a network interface ... L75: /** L76: * THE ONE-SHOT VERBS, as data: which module holds each, and which function

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.mjsView on unpkg · L42

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/cli.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.mjsView on unpkg

143*/ L144: const { coverageRows } = await import('./footprint/surfaces.mjs'); L145: console.log('');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L143

bin/footprint/agent-files.mjsView file

76Install-time code directly mutates a foreign AI-agent control surface: L76: * a coin-flip bug. It was the test harness: the same prompt returns empty on ~1 of 3 runs L77: * with the skills split, with the content in CLAUDE.md instead, and with no skill present L78: * at all — so headless `-p` intermittently ends a turn with no text here regardless. The ... L99: * L100: * CLAUDE CODE ONLY, on purpose. `.claude/commands/<name>.md` is a project-scoped slash L101: * command named by its filename. Cursor's and Codex's equivalents differ, and guessing a ... L107: const COMMANDS = [ L108: { file: 'SEND-COMMAND.md', marker: '.claude', at: '.claude/commands/silt-send.md' }, L109: ]; ... L122: * sk[redacted] 53% (the skill was never invoked in 56% of cases), skills plus an L123: * explicit instructi

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/footprint/agent-files.mjsView on unpkg · L76

bin/push/push-readiness.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/push/push-readiness.mjs#virtual:normalized:round1View on unpkg

bin/silt/silt-binary.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/silt/silt-binary.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt/silt-binary.mjsView on unpkg

bin/silt/silt-link.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/silt/silt-link.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt/silt-link.mjsView on unpkg

bin/start.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/start.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/start.mjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 2-42json

2 "name": "silt-design-mode",

3 "version": "0.1.18",

4 "description": "Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.",

5 "license": "SEE LICENSE IN LICENSE",

6 "homepage": "https://silt.app",

7 "engines": {

8 "node": "^22.18.0 || >=24.11.0"

9 },

10 "type": "module",

11 "main": "./dist/index.js",

12 "scripts": {

13 "lab": "vite",

14 "check": "tsc --noEmit",

15 "lint": "eslint src bin build lab test",

16 "build:lab": "vite build",

17 "build": "vite build -c vite.lib.config.ts && tsc -p tsconfig.build.json",

18 "test": "npm run build && node --test test/*.test.mjs",

19 "test:e2e": "playwright test",

20 "prepack": "npm run build",

21 "pack:web": "npm pack",

22 "postinstall": "node bin/footprint/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "dependencies": {

25 "@babel/parser": "^8.0.4",

26 "magicast": "^0.5.4"

27 },

28 "devDependencies": {

29 "@hugeicons/core-free-icons": "^1.1.0",

30 "@hugeicons/react": "^1.1.0",

31 "@playwright/test": "^1.62.1",

32 "@types/node": "^22.20.1",

33 "@types/react": "18.3.3",

34 "@types/react-dom": "18.3.0",

35 "@vitejs/plugin-react": "^4.3.4",

36 "dialkit": "^1.4.3",

37 "eslint": "^10.8.0",

38 "react": "18.3.1",

39 "react-dom": "18.3.1",

40 "typescript": "~5.6.3",

41 "typescript-eslint": "^8.66.0",

42 "vite": "^6.3.5"

bin/cli.mjsView file

Lines 22-62javascript

22 * non-interactive mode, because it is what this repo's users already have

23 * authenticated; override with DM_RUNNER (a shell command that receives the

24 * prompt on stdin, with {model} and {file} placeholders) to use anything else.

25 *

26

bin/footprint/agent-files.mjsView file

Lines 56-96javascript

56 * on trigger clarity alone: an agent asked to "set up silt and log in" should not have to

57 * read 6 KB of "make exactly those edits / change nothing / report per annotation" to

58 * reach the four commands it needs.

59 *

bin/push/push-readiness.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/push/push-readiness.mjs#virtual:normalized:round1View on unpkg

bin/silt/silt-binary.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/silt/silt-binary.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt/silt-binary.mjsView on unpkg

bin/silt/silt-link.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/silt/silt-link.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt/silt-link.mjsView on unpkg

bin/start.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.15 matchedPath = bin/start.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/start.mjsView on unpkg