registry / @fastify-core/base / 1.0.2

@fastify-core/base@1.0.2

Fastify Core là một library backend dùng cho ứng dụng Fastify, tập trung vào các thành phần thường gặp trong hệ thống API: model layer, request handling, file upload, JWT, validation, route và utility helpers.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

npm installation mutates the consuming project's package manifest without consent. It can create that manifest and adds this package's missing peer dependencies after installation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

Unexpected dependency injection and persistent project-manifest modification.

Mechanism

detached delayed rewrite of the consuming project's package.json

Attack narrative

On installation, package.json runs scripts/postinstall.cjs. The hook resolves INIT_CWD (or an ancestor of node_modules), creates that project's package.json when absent, then spawns a detached Node process. After 1.5 seconds, the child adds every missing peer dependency from this package to the consuming project's dependencies and writes the manifest, with output suppressed. This is an unconsented install-time mutation outside the package.

Rationale

The package performs concealed, unconsented modification of a foreign project manifest during postinstall. No network or credential theft was found, but dependency injection alone is concrete malicious install-time behavior.

Evidence

package.jsonscripts/postinstall.cjsdist/index.mjs${INIT_CWD}/package.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

@fastify-core/base@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code