registry / @atlassecurity/auth / 1.0.2

@atlassecurity/auth@1.0.2

Atlas SDK - Node.js binding for Atlas.dll (Windows x64).

AI Security Review

scanned 21d ago · by lpm-firewall-ai

An npm postinstall hook fetches a newer remote release and replaces installed package code. The downloaded JavaScript will run when the package is later imported.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install, npm ci, or npm update

Impact

A remote repository release can replace package.json and src/index.js in the consumer installation, enabling later arbitrary package code execution.

Mechanism

Unauthenticated remote update followed by installed-file replacement

Attack narrative

On installation, package.json invokes postinstall.js. That script requests the latest GitHub release, downloads designated assets, and renames them over the installed src/index.js and package.json. It does not authenticate the downloaded bytes with a hash or signature and suppresses failures. A repository-side release change can therefore replace code in a consumer dependency during installation and run when the module is imported.

AI rationale

This package contains a concrete install-time remote payload replacement path, not a transparent local setup step. It changes executable package source and its manifest without user action or integrity verification.

Evidence

package.jsonpostinstall.jssrc/index.jssrc/index.js.newpackage.json.new

Network endpoints6

api.github.com/repos/atlassecuritysolutions/AtlasAuthentication-JS/releases/latest

@atlassecurity/auth@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code