registry / Destructive action / @aj-shadow/actorjs-app
@aj-shadow/actorjs-app
Library used by @aj-shadow/actorjs
This report shows the evidence for @aj-shadow/actorjs-app@0.0.0-aj-beta.271. 7 of 20 known versions are blocked or flagged. The newest version, 0.0.0-aj-beta.272, is flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall hook performs broad, destructive changes to the surrounding application and shell startup configuration. The source establishes active recursive deletion and file replacement, so this warrants blocking publication.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package through npm, which invokes its postinstall hook.
Impact
Existing application data or build outputs may be lost or replaced, and shell startup behavior may be changed without a separate user action.
Mechanism
The hook removes build, dist, and temp directories and processes a hardcoded list of application paths by removing destination paths recursively and renaming package paths into their place. It also appends aliases to shell startup files.
Attack narrative
npm automatically invokes the postinstall script. That script deletes directories above the installed package and removes destination paths before moving package content, including project and workspace directories, into the parent application. On Unix systems it also appends aliases to shell startup files. These mutations run as part of installation without a separate confirmation.
AI rationale
The postinstall hook performs broad, destructive changes to the surrounding application and shell startup configuration. The source establishes active recursive deletion and file replacement, so this warrants blocking publication.
Evidence
package.jsonnpm-post-install.js
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs npm-post-install.js automatically during postinstall.
- The installer removes build directories above the package, recursively and without prompting.
- The active npm path removes existing destinations and moves package files, including project and workspace directories, into the parent application.
- The installer also writes aliases into shell startup files without a consent check.
Evidence against
- The package describes itself as a library used by @aj-shadow/actorjs, and the installer creates launchers for the application.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('./npm[redacted]')}catch(e){console.log(e);}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('./npm[redacted]')}catch(e){console.log(e);}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgproject/server/plugin-data/repos/plugin_data_ReposVerifyGit.jsView file
3L4: const PluginBaseMulti = require('z-abs-corelayer-server/server/plugin-base-multi');
L5: const Os = require('os');
Medium
Dynamic Require
Findings
1 Critical3 High3 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedproject/server/plugin-data/test-suite/plugin_data_TestSuiteExecutionStart.js
HighKnown Malware Source Fingerprint Signaturenpm-post-install.js
MediumDynamic Requireproject/server/plugin-data/repos/plugin_data_ReposVerifyGit.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @aj-shadow/actorjs-app@0.0.0-aj-beta.271.
The versions list below shows the verdict for each recorded version.
- Avoid installing @aj-shadow/actorjs-app@0.0.0-aj-beta.271. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.