Loading npm security reports…

silt-design-mode@0.1.8: AI-agent control-surface risk | LPM Firewall

registry / silt-design-mode / 0.1.8

silt-design-mode@0.1.8

Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consumer project’s broad AI-agent instruction surface. It appends AGENTS.md content and can create Claude skill and command files without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

An attacker-controlled package can steer coding agents in the consumer repository and suppress source inspection before the user invokes its CLI.

Mechanism

Automatic project-wide AI-agent instruction injection.

Policy narrative

During npm installation, postinstall uses INIT_CWD to target the consumer project. The installer unconditionally creates or modifies AGENTS.md, a broad agent control file, then may create Claude skills and a slash command based on a machine-level Claude directory. Its injected text directs agents to follow package-provided instructions and not inspect package source. This is an unconsented install-time modification of a foreign AI-agent control surface.

AI rationale

The package performs an automatic postinstall write into broad project agent configuration and can create new agent files in a repository that has not explicitly requested setup. The injected instructions steer agents away from inspecting the package source, making this concrete install-hook abuse.

Evidence

package.jsonbin/postinstall.mjsbin/skill-install.mjsskill/AGENTS-BLOCK.mdAGENTS.md.claude/skills/silt-design-mode/SKILL.md.claude/skills/silt-setup/SKILL.md

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.mjsView file

42Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L42: */ L43: import { execFileSync, spawn } from 'node:child_process'; L44: import { randomUUID } from 'node:crypto'; L45: import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'; L46: import { createServer } from 'node:http'; L47: import { join, resolve } from 'node:path'; ... L64: * that port and fail if it is taken; a stated port is a decision, not a hint. */ L65: const EXPLICIT_PORT = process.env.DM_PORT ?? argOf('--port'); L66: const HOST = '127.0.0.1'; // loopback only — this must never listen on a network interface ... L75: /** L76: * THE ONE-SHOT VERBS, as data: which module holds each, and which function

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.mjsView on unpkg · L42

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/cli.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.mjsView on unpkg

129const { from, call } = VERBS[cmd]; L130: const mod = await import(from); L131: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L129

bin/skill-install.mjsView file

74Install-time code directly mutates a foreign AI-agent control surface: L74: * a coin-flip bug. It was the test harness: the same prompt returns empty on ~1 of 3 runs L75: * with the skills split, with the content in CLAUDE.md instead, and with no skill present L76: * at all — so headless `-p` intermittently ends a turn with no text here regardless. The ... L97: * L98: * CLAUDE CODE ONLY, on purpose. `.claude/commands/<name>.md` is a project-scoped slash L99: * command named by its filename. Cursor's and Codex's equivalents differ, and guessing a ... L105: const COMMANDS = [ L106: { file: 'SEND-COMMAND.md', marker: '.claude', at: '.claude/commands/silt-send.md' }, L107: ]; ... L120: * sk[redacted] 53% (the skill was never invoked in 56% of cases), skills plus an L121: * explicit instruction

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/skill-install.mjsView on unpkg · L74

bin/push-readiness.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/push-readiness.mjs#virtual:normalized:round1View on unpkg

bin/silt-binary.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/silt-binary.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt-binary.mjsView on unpkg

bin/silt-link.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/silt-link.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt-link.mjsView on unpkg

bin/start.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/start.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/start.mjsView on unpkg

bin/push-readiness.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/push-readiness.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/push-readiness.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 2-42json

2 "name": "silt-design-mode",

3 "version": "0.1.8",

4 "description": "Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.",

5 "license": "SEE LICENSE IN LICENSE",

6 "homepage": "https://silt.app",

7 "engines": {

8 "node": "^22.18.0 || >=24.11.0"

9 },

10 "type": "module",

11 "main": "./dist/index.js",

12 "scripts": {

13 "lab": "vite",

14 "check": "tsc --noEmit",

15 "lint": "eslint src bin build lab test",

16 "build:lab": "vite build",

17 "build": "vite build -c vite.lib.config.ts && tsc -p tsconfig.build.json",

18 "test": "npm run build && node --test test/*.test.mjs",

19 "test:e2e": "playwright test",

20 "prepack": "npm run build",

21 "pack:web": "npm pack",

22 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "dependencies": {

25 "@babel/parser": "^8.0.4",

26 "magicast": "^0.5.4"

27 },

28 "devDependencies": {

29 "@hugeicons/core-free-icons": "^1.1.0",

30 "@hugeicons/react": "^1.1.0",

31 "@playwright/test": "^1.62.1",

32 "@types/node": "^22.20.1",

33 "@types/react": "18.3.3",

34 "@types/react-dom": "18.3.0",

35 "@vitejs/plugin-react": "^4.3.4",

36 "dialkit": "^1.4.3",

37 "eslint": "^10.8.0",

38 "react": "18.3.1",

39 "react-dom": "18.3.1",

40 "typescript": "~5.6.3",

41 "typescript-eslint": "^8.66.0",

42 "vite": "^6.3.5"

bin/cli.mjsView file

Lines 22-62javascript

22 * non-interactive mode, because it is what this repo's users already have

23 * authenticated; override with DM_RUNNER (a shell command that receives the

24 * prompt on stdin, with {model} and {file} placeholders) to use anything else.

25 *

26

bin/skill-install.mjsView file

Lines 54-94javascript

54 * on trigger clarity alone: an agent asked to "set up silt and log in" should not have to

55 * read 6 KB of "make exactly those edits / change nothing / report per annotation" to

56 * reach the four commands it needs.

57 *

bin/push-readiness.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/push-readiness.mjs#virtual:normalized:round1View on unpkg

bin/silt-binary.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/silt-binary.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt-binary.mjsView on unpkg

bin/silt-link.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/silt-link.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/silt-link.mjsView on unpkg

bin/start.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/start.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/start.mjsView on unpkg

bin/push-readiness.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.7 matchedPath = bin/push-readiness.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/push-readiness.mjsView on unpkg