@dobot-plus/skill: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@dobot-plus/skill: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

install.jsView file

11process.env.DOBOT_SKILL_INSTALL_DIR || L12: path.join(require("os").homedir(), ".agents", "skills"), L13: SKILL_NAME ... L25: function copySkillFiles(targetDir) { L26: fs.mkdirSync(targetDir, { recursive: true }) L27: ... L30: const dest = path.join(targetDir, entry) L31: fs.cpSync(source, dest, { recursive: true, force: true }) L32: } ... L36: const pkg = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf8")) L37: fs.writeFileSync(path.join(targetDir, "package.json"), JSON.stringify({ L38: name: pkg.name,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

install.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = install.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg

scripts/generate.jsView file

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = scripts/generate.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/generate.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @dobot-plus/skill@1.4.3 matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.4.3 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/generate.jsView on unpkg

scripts/http.jsView file

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = scripts/http.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/http.jsView on unpkg

scripts/httpApi.jsView file

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = scripts/httpApi.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/httpApi.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-24json

1{

2 "name": "@dobot-plus/skill",

3 "version": "1.6.4",

4 "description": "Agent skill for Dobot+ plugin development",

5 "license": "ISC",

6 "author": "",

7 "type": "commonjs",

8 "main": "index.js",

9 "files": [

10 "SKILL.md",

11 "scripts",

12 "references",

13 "install.js"

14 ],

15 "scripts": {

16 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "release": "npm publish --access public",

18 "test": "echo \"Error: no test specified\" && exit 1"

19 },

20 "dependencies": {

21 "ajv": "^8.20.0"

22 }

23}

24

install.jsView file

Lines 1-31javascript

1const { fork } = require("child_process")

2const fs = require("fs")

3const path = require

scripts/generate.jsView file

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = scripts/generate.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/generate.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @dobot-plus/skill@1.4.3 matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.4.3 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/generate.jsView on unpkg

scripts/http.jsView file

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = scripts/http.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/http.jsView on unpkg

scripts/httpApi.jsView file

•matchType = normalized_sha256 matchedPackage = @dobot-plus/skill@1.6.0 matchedPath = scripts/httpApi.js matchedIdentity = npm:QGRvYm90LXBsdXMvc2tpbGw:1.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/httpApi.jsView on unpkg