@einsia/agent-git@0.2.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@einsia/agent-git@0.2.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node npm/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

npm/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @einsia/agent-git@0.2.1 matchedPath = npm/postinstall.js matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e062b3b074414638 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @einsia/agent-git@0.2.1 matchedPath = npm/postinstall.js matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.1 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

npm/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @einsia/agent-git@0.2.13 matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.13 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

npm/postinstall.jsView on unpkg

npm/lib/run.jsView file

•matchType = normalized_sha256 matchedPackage = @einsia/agent-git@0.2.1 matchedPath = npm/lib/run.js matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/lib/run.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 20-59json

20 "homepage": "https://agent-git.com",

21 "repository": {

22 "type": "git",

23 "url": "git+https://github.com/Einsia/agent-git.git"

24 },

25 "bugs": {

26 "url": "https://github.com/Einsia/agent-git/issues"

27 },

28 "bin": {

29 "agit": "npm/shim.js"

30 },

31 "files": [

32 "npm/shim.js",

33 "npm/postinstall.js",

34 "npm/lib/",

35 "npm/README.md",

36 "README.md",

37 "CHANGELOG.md"

38 ],

39 "scripts": {

40 "postinstall": "node npm/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "check-version": "node scripts/check-version.js",

42 "bump-version": "node scripts/bump-version.mjs",

43 "prepack": "node scripts/check-version.js"

44 },

45 "engines": {

46 "node": ">=20"

47 },

48 "publishConfig": {

49 "access": "public"

50 },

51 "optionalDependencies": {

52 "@einsia/agent-git-linux-x64": "0.2.3",

53 "@einsia/agent-git-linux-arm64": "0.2.3",

54 "@einsia/agent-git-darwin-x64": "0.2.3",

55 "@einsia/agent-git-darwin-arm64": "0.2.3",

56 "@einsia/agent-git-win32-x64": "0.2.3"

57 }

58}

59

npm/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @einsia/agent-git@0.2.1 matchedPath = npm/postinstall.js matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e062b3b074414638 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @einsia/agent-git@0.2.1 matchedPath = npm/postinstall.js matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.1 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

npm/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @einsia/agent-git@0.2.13 matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.13 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

npm/postinstall.jsView on unpkg

npm/lib/run.jsView file

•matchType = normalized_sha256 matchedPackage = @einsia/agent-git@0.2.1 matchedPath = npm/lib/run.js matchedIdentity = npm:QGVpbnNpYS9hZ2VudC1naXQ:0.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

npm/lib/run.jsView on unpkg