@aj-shadow/actorjs-app@0.0.0-aj-beta.254
Library used by @aj-shadow/actorjs
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe source supports a warning for automatic destructive filesystem operations with unchecked destination assumptions. Transparent ActorJs deployment behavior and the absence of a malicious self-dependency or exfiltration chain do not support blocking as malware.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall execution.
Impact
Existing directories and files at an unintended destination may be lost or overwritten.
Mechanism
Fixed parent traversal selects a destination, followed by forced recursive deletion and application-file relocation.
AI rationale
The source supports a warning for automatic destructive filesystem operations with unchecked destination assumptions. Transparent ActorJs deployment behavior and the absence of a malicious self-dependency or exfiltration chain do not support blocking as malware.
Evidence
package.jsonnpm-post-install.jsbuilddisttemp.vscodeprojectworkspaceREADME.mdCHANGELOG.mdcontributors.txtsettings.jsonLicense agreement ActorJs.pdfmain.jsrepos.jsonserver-test-case.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json automatically loads npm-post-install.js after installation; runtime dependencies are empty.
- npm-post-install.js targets a directory three parents above the package without verifying ownership.
- The installer recursively deletes build, dist and temp at that destination.
- The installer removes existing destinations before moving project, workspace, .vscode and other application files there.
Evidence against
- The transparent installer creates ActorJs launchers and shell aliases, consistent with application deployment.
- No obfuscation, runtime self-dependency, credential exfiltration or foreign AI-agent control mutation was identified.
- The flagged test-suite file implements request-driven test execution; its build markers explain the parser limitation.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemShellWebSocket
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('./npm[redacted]')}catch(e){console.log(e);}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('./npm[redacted]')}catch(e){console.log(e);}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg12"postinstall": "node -e \"try{require('./npm[redacted]')}catch(e){console.log(e);}\""
},
"dependencies": {},
"repository"
Medium
Suspicious Dependency Evidence
package.json automatically loads npm-post-install.js after installation; runtime dependencies are empty.
package.jsonView on unpkg · L12project/server/plugin-data/repos/plugin_data_ReposVerifyGit.js
Findings
1 Critical2 High4 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedproject/server/plugin-data/test-suite/plugin_data_TestSuiteExecutionStart.js
MediumDynamic Requireproject/server/plugin-data/repos/plugin_data_ReposVerifyGit.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Dependency Evidencepackage.json
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @aj-shadow/actorjs-app@0.0.0-aj-beta.254.
See all versions of @aj-shadow/actorjs-app for other recorded verdicts.
- Review the evidence and your use of @aj-shadow/actorjs-app@0.0.0-aj-beta.254 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.