> ## Documentation Index
> Fetch the complete documentation index at: https://docs.svrnos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GER-403 · Trusted-Component Trojan

> Installed third-party executable component (skill, plugin, MCP server, extension, agent tool) is trusted at install-time and carries dormant trigger-activated malicious behavior that standard validation passes clean.

export const Badge = ({children, tone = "default", title}) => {
  const tones = {
    default: "bg-neutral-100 text-neutral-700",
    green: "bg-green-100 text-green-900",
    amber: "bg-amber-100 text-amber-900",
    blue: "bg-blue-50 text-blue-900",
    gray: "bg-neutral-50 text-neutral-600"
  };
  return <span className={`inline-flex items-center px-2 py-0.5 text-xs font-mono uppercase tracking-wider rounded ${tones[tone] ?? tones.default}`} title={title}>
      {children}
    </span>;
};

<div className="flex flex-wrap gap-2 mb-8 mt-2">
  <Badge tone="green">Documented</Badge> <Badge>Tier 4xx</Badge> <Badge>Layer L2</Badge> <Badge tone="blue" title="SVRNOS-assigned code in an HTTP-unassigned slot">Namespace-Claim</Badge> <Badge tone="gray">Added v0.2</Badge>
</div>

*Operator / Platform Errors*

## Definition

Installed third-party executable component (skill, plugin, MCP server, extension, agent tool) is trusted at install-time and carries dormant trigger-activated malicious behavior that standard validation passes clean.

## Distinct from

* [**GER-401**](/ger/codes/401) — Component authorization gate never installed → this code. User identity gate never installed → GER-401.
* [**GER-412**](/ger/codes/412) — Component install inflection → this code. Config-load inflection → GER-412.
* [**GER-431**](/ger/codes/431) — Component install-time inflection point → this code. Vendor update inflection point → GER-431.

## Documented case

<Card title="Malicious Nx npm Packages Reportedly Weaponize AI Coding Agents for Data Exfiltration" href="https://incidentdatabase.ai/cite/1210">
  AIID #1210
</Card>

## Tags

`l2` · `supply-chain`

### Cite

```
SVRNOS. (2026). GER-403: Trusted-Component Trojan. Governance Error Register. https://docs.svrnos.com/ger/codes/403
```