registry / Credential exfiltration / @evial/runtime-utils
@evial/runtime-utils
Collect runtime environment snapshots for debugging aid packages.
This report shows the evidence for @evial/runtime-utils@1.0.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe install hook performs broad, unconsented environment harvesting and writes potentially secret data outside its package directory. Lack of observed network egress does not make the credential collection benign.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing @evial/runtime-utils@1.0.1
Impact
Potential credential disclosure to workspace-readable logs and unconsented host reconnaissance.
Mechanism
install-time environment harvesting and workspace log writes
Attack narrative
On installation, the package launches a postinstall hook that runs host-identification commands, enumerates all environment variables with values, and writes the result to workspace-relative and absolute workspace log locations. This can capture cloud credentials and other secrets without user action.
AI rationale
The install hook performs broad, unconsented environment harvesting and writes potentially secret data outside its package directory. Lack of observed network egress does not make the credential collection benign.
Evidence
package.jsonscripts/postinstall.jsruntime-snapshot.log/workspace/runtime-snapshot.log
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Postinstall automatically executes scripts during npm installation.
- The hook captures every environment-variable value, including potential credentials.
- It writes the collected host and environment snapshot to workspace-related paths.
Evidence against
- No network endpoint or outbound request is present in the inspected files.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @evial/runtime-utils@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @evial/runtime-utils@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.