registry / AI-agent control-surface risk / ux-atlas

ux-atlas

UX skills for agents. Each skill is skills/<name>/SKILL.md.

This report shows the evidence for ux-atlas@0.1.6. 5 of 6 known versions are blocked or flagged. The newest version, 0.1.7, is flagged. See all versions.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The active postinstall hook writes package-controlled behavior into foreign agent instruction files without an affirmative consent gate. This is an unconsented install-time AI-agent control-surface mutation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A local npm installation runs the postinstall hook.

Impact

The package automatically changes agent behavior and routing in the consuming project.

Mechanism

The hook resolves the consumer project root, then updates or creates AGENTS.md and CLAUDE.md with package-provided pointers and removes a matching legacy instruction.

Policy narrative

During local installation, postinstall updates the consumer's root AGENTS.md and CLAUDE.md without asking first. Those files receive package-controlled agent instructions, which alter request routing and skill loading.

AI rationale

Evidence

package.jsonscripts/init.mjsinstructions/AGENTS.mdAGENTS.mdCLAUDE.md.atlas/config.json.atlas/README.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/init.mjs from postinstall.
The local postinstall path resolves the consumer project root and calls applyPointers without an affirmative consent check.
applyPointers edits root AGENTS.md and CLAUDE.md, removing a legacy instruction and adding package instructions.
The upsert routine writes the resulting content to those files.
The injected AGENTS.md instructions direct how the agent routes requests and loads skills.

Evidence against

The installer skips global installs.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 10.9 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 4-36json

4 "version": "0.1.6",

5 "private": false,

6 "description": "UX skills for agents. Each skill is skills/<name>/SKILL.md.",

7 "license": "MIT",

8 "repository": {

9 "type": "git",

10 "url": "git+https://github.com/ajdcabrera-design/ux-atlas.git"

11 },

12 "files": [

13 "skills",

14 "instructions",

15 "scripts/init.mjs",

16 "scripts/scan.mjs"

17 ],

18 "bin": {

19 "ux-atlas": "scripts/init.mjs"

20 },

21 "exports": {

22 "./skills/*": "./skills/*"

23 },

24 "scripts": {

25 "lint": "eslint .",

26 "postinstall": "node scripts/init.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 "index": "node scripts/skill-index.mjs",

28 "test": "node --test scripts/*.test.mjs"

High

Suspicious Lifecycle Evidence

package.json runs scripts/init.mjs from postinstall.

package.jsonView on unpkg · L24

29 },

30 "devDependencies": {

31 "@eslint/js": "^10.0.1",

32 "eslint": "^10.11.0",

33 "globals": "^17.12.0"

34 }

35}

scripts/scan.mjsView file

Lines 85-125javascript

85 return groups.map((g) => `${g.name}(${g.values.join('|')})`);

86}

scripts/init.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import path from 'node:path';

4import { fileURLToPath } from 'node:url';

6const START

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/init.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

24"scripts": { "lint": "eslint .", "postinstall": "node scripts/init.mjs", "index": "node scripts/sk[redacted]", "test":

High

Suspicious Lifecycle Evidence

package.json runs scripts/init.mjs from postinstall.

package.jsonView on unpkg · L24

scripts/scan.mjsView file

105const content = fs.readFileSync(file); L106: const text = content.toString('utf8'); L107: if (isTokens) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/scan.mjsView on unpkg · L105

Findings

1 Critical5 High2 Medium4 Low

CriticalAi Agent Control Hijackscripts/init.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighExternal Ai Agent Control Surface Mutationscripts/init.mjs

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencescripts/init.mjs

HighAi Review Evidencescripts/init.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoscripts/scan.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to ux-atlas@0.1.6.

The versions list below shows the verdict for each recorded version.

Avoid installing ux-atlas@0.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-18 11:24:52.856Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

0.1.7latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 18, 2026, 12:43 PM 0.1.6shownMaliciousSoft block: AI-agent control surfaceBlockPublishedOct 18, 2026, 11:22 AM 0.1.5MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 15, 2026, 8:21 AM 0.1.4MaliciousSoft block: AI-agent control surfaceBlockPublishedOct 15, 2026, 12:52 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code