@fastify-core/single@1.0.3
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an unconsented install-time mutation of a foreign project manifest, concealed behind a detached process. It is a real supply-chain risk, but source inspection found no exfiltration, remote execution, destructive action, or AI-agent control-surface write to justify a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install executes postinstall.
Impact
Unexpected dependency injection into the consuming project; it may affect a subsequent install.
Mechanism
detached lifecycle-script mutation of the consumer manifest
AI rationale
This is an unconsented install-time mutation of a foreign project manifest, concealed behind a detached process. It is a real supply-chain risk, but source inspection found no exfiltration, remote execution, destructive action, or AI-agent control-surface write to justify a block.
Evidence
package.jsonscripts/postinstall.cjs<consumer-project>/package.json
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- postinstall runs automatically on npm install.
- It resolves the consuming project root and targets its package.json.
- It creates or silently rewrites the consumer manifest to add missing peer dependencies.
- The rewrite occurs in a detached background Node process after installation.
Evidence against
- No network endpoint, credential harvesting, or exfiltration was found.
- Published dist modules contain application/controller utilities; no additional install-time execution was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.cjsView file
•matchType = normalized_sha256
matchedPackage = @fastify-core/single@1.0.2
matchedPath = scripts/postinstall.cjs
matchedIdentity = npm:QGZhc3RpZnktY29yZS9zaW5nbGU:1.0.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.cjsView on unpkgFindings
2 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityscripts/postinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @fastify-core/single@1.0.3.
See all versions of @fastify-core/single for other recorded verdicts.
- Review the evidence and your use of @fastify-core/single@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.