registry / Install hook abuse / @atlassecurity/auth
@atlassecurity/auth
Atlas SDK - Node.js binding for Atlas.dll (Windows x64).
This report shows the evidence for @atlassecurity/auth@1.0.3. 2 of 6 known versions are blocked or flagged. The newest version, 1.1.4, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete install-hook supply-chain mechanism, not a normal transparent setup step. It remotely replaces executable package code and package metadata during installation.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install, npm ci, or npm update
Impact
A remote release publisher can change code executed by consumers after installation while retaining a locally configured API key.
Mechanism
postinstall remote payload download and atomic source replacement
Attack narrative
The package-manager postinstall hook queries a remote GitHub release. When its version is newer, it downloads remote assets and overwrites the installed entrypoint and package manifest. The downloaded code is not signed or hash-verified by the hook, and the hook preserves an existing API key while replacing the source. This creates an unconsented install-time remote code-update channel outside normal npm package integrity and review.
AI rationale
This is a concrete install-hook supply-chain mechanism, not a normal transparent setup step. It remotely replaces executable package code and package metadata during installation.
Evidence
package.jsonpostinstall.jssrc/index.js%LOCALAPPDATA%\AtlasAuth\dev_marker.json
Network endpoints6
api.github.com/repos/atlassecuritysolutions/AtlasAuthentication-JS/releases/latestapi.github.comgithub.comobjects.githubusercontent.comraw.githubusercontent.comrelease-assets.githubusercontent.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs postinstall automatically.
- The install hook fetches a newer remote release and selects replacement source and manifest assets.
- The hook atomically overwrites its installed src/index.js and package.json with downloaded bytes.
- It reads and reinserts an existing API key into the downloaded source, preserving a secret-bearing local customization through the replacement.
Evidence against
- The install hook only names GitHub-controlled asset hosts.
- No direct host-fingerprint upload or environment-value exfiltration appears in the inspected JavaScript.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
11// 2. Fetch releases/latest from the JS repo. If newer than what
L12: // just installed, download the new src/index.js + package.json
L13: // and atomic-swap them in place, preserving the dev's API_KEY.
...
L24: const os = require('os');
L25: const https = require('https');
L26:
...
L34: try {
L35: const local = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
L36: const dir = path.join(local, 'AtlasAuth');
...
L52: try {
L53: const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
L54: return pkg.version || '0.0.0';
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHost Fingerprint Exfiltrationpostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Native BinaryAtlas.dll
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @atlassecurity/auth@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @atlassecurity/auth@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.