registry / @evial/runtime-utils / 1.0.1

@evial/runtime-utils@1.0.1

Collect runtime environment snapshots for debugging aid packages.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm postinstall collects host identity, command output, and all environment values. It writes that snapshot outside the package directory to likely workspace paths.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing @evial/runtime-utils@1.0.1

Impact

Potential credential disclosure to workspace-readable logs and unconsented host reconnaissance.

Mechanism

install-time environment harvesting and workspace log writes

Attack narrative

On installation, the package launches a postinstall hook that runs host-identification commands, enumerates all environment variables with values, and writes the result to workspace-relative and absolute workspace log locations. This can capture cloud credentials and other secrets without user action.

Rationale

The install hook performs broad, unconsented environment harvesting and writes potentially secret data outside its package directory. Lack of observed network egress does not make the credential collection benign.

Evidence

package.jsonscripts/postinstall.jsruntime-snapshot.log/workspace/runtime-snapshot.log

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

@evial/runtime-utils@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code