registry / AI-agent control-surface risk / ts-inspect-cli
ts-inspect-cli
A read-only TypeScript semantic inspection CLI built on ts-morph
This report shows the evidence for ts-inspect-cli@0.1.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe postinstall behavior is concrete, silent, and modifies consumer-owned AI-agent configuration by default. That meets the install-control-surface block boundary despite the absence of exfiltration or networking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install (postinstall)
Impact
Unconsented alteration of broad project AI-agent behavior.
Mechanism
silent postinstall writes to consumer AI-agent configuration files
Policy narrative
Installation invokes `node dist/ts-inspect.js setup --silent`. With no target flags, setup selects Cursor, Claude, and AGENTS targets, then writes package-controlled instruction files into the consuming project and modifies AGENTS.md without prompting or consent. This is install-time mutation of foreign AI-agent control surfaces.
AI rationale
The postinstall behavior is concrete, silent, and modifies consumer-owned AI-agent configuration by default. That meets the install-control-surface block boundary despite the absence of exfiltration or networking.
Evidence
package.jsondist/ts-inspect.jsrules/cursor/ts-inspect.mdcrules/claude/ts-inspect/SKILL.mdrules/AGENTS.md.cursor/rules/ts-inspect.mdc.claude/skills/ts-inspect/SKILL.mdAGENTS.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs `setup --silent` in postinstall.
- dist/ts-inspect.js defaults setup to Cursor, Claude, and AGENTS targets.
- Silent install writes consumer `.cursor/rules/ts-inspect.mdc` and `.claude/skills/ts-inspect/SKILL.md`.
- It also creates or modifies the consumer project's AGENTS.md.
Evidence against
- No network, credential harvesting, shell execution, or remote payload path found.
- Bundled rule files describe a read-only TypeScript inspection CLI.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/ts-inspect.js setup --silent
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node dist/ts-inspect.js setup --silent
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/ts-inspect.jsView file
26var SETUP_FLAG_DRY_RUN = "--dry-run";
L27: var SETUP_CURSOR_RULES_DIR = ".cursor/rules";
L28: var SETUP_CURSOR_RULE_FILENAME = "ts-inspect.mdc";
L29: var SETUP_CLAUDE_SKILLS_DIR = ".claude/skills";
L30: var SETUP_CLAUDE_SKILL_DIR_NAME = "ts-inspect";
L31: var SETUP_CLAUDE_SKILL_FILENAME = "SKILL.md";
L32: var SETUP_AGENTS_FILENAME = "AGENTS.md";
L33: var SETUP_AGENTS_SENTINEL_START = "<!-- ts-inspect:start -->";
...
L37: var SETUP_CLAUDE_SOURCE_DIR = "rules/claude/ts-inspect";
L38: var SETUP_AGENTS_SOURCE_PATH = "rules/AGENTS.md";
L39: var SETUP_PACKAGE_JSON_FILENAME = "package.json";
...
L60: existsSync,
Findings
1 Critical1 High3 Medium3 Low
CriticalAi Agent Control Hijackdist/ts-inspect.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to ts-inspect-cli@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing ts-inspect-cli@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.