registry / Malware / @fayz-ai/portal

@fayz-ai/portal

Fayz SDK member/learner portal scaffold — authenticated 'my courses' + player surface

This report shows the evidence for @fayz-ai/portal@0.69.0. 1 of 36 known versions is blocked or flagged. The newest version, 0.77.0, is allowed. See all versions.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The default runtime path makes a publisher-selected account change by enrolling authenticated members in every published course. Under the review policy, this is concrete attack behavior; the package has no install hook, but the runtime behavior supports blocking publication.

Static reason

No blocking static signals were detected.

Trigger

Member session initialization, sign-in, or signup.

Impact

Creates enrollment records for courses the member did not individually select.

Mechanism

The bundle lists all published courses and calls the provider enrollment method for each using the member ID derived from their email.

Attack narrative

The default authentication flow automatically enrolls each member in all published courses. The bundle performs this action when it links a member session, and both session establishment and signup reach that path. The source does not show an individual course selection or consent check before enrollment.

AI rationale

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

On authentication, the bundle enrolls the member in every published course by default.
Both session establishment and explicit signup call the enrollment path after authentication.

Evidence against

The manifest describes an authenticated member portal and has no install lifecycle hook.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 22.3 KB of source

Source & flagged code

3 flagged

dist/index.jsView file

66async function grantAllPublished(customerId) { const provider = getCoursesProvider(); const courses = await provider.listCourses({ status: "published" }); for (const c of courses) await provider.enroll(c.id, customerId); } async function link(user, fullName) { const email = (user.email ?? "").trim().toLowerCase(); const customerId = customerIdForEmail(email); if (_autoEnroll) await grantAllPublished(customerId); useMemberSession.getState().setSession({

High

Ai Review Evidence

On authentication, the bundle enrolls the member in every published course by default.

dist/index.jsView on unpkg · L66

78async function establishMemberSession(email, opts) { const adapter2 = getAdapter(); const normalized = email.trim().toLowerCase(); const session = opts?.password ? await adapter2.signIn(normalized, opts.password) : await adapter2.signUp(normalized, `member-${normalized}`, opts?.name ?? ""); const user = session.user.email ? session.user : { ...session.user, email: normalized }; return link(user, opts?.name); } async function s

High

Ai Review Evidence

Both session establishment and explicit signup call the enrollment path after authentication.

dist/index.jsView on unpkg · L78

package.jsonView file

Findings

3 High2 Low

HighAi Review Evidencedist/index.js

HighAi Review Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @fayz-ai/portal@0.69.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @fayz-ai/portal@0.69.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-25 19:24:45.103Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

36 known versions

0.77.0latestUnknown—AllowUnder ReviewOct 29, 2026, 8:30 PM 0.75.0Unknown—AllowUnder ReviewOct 27, 2026, 11:13 PM 0.74.0Unknown—AllowUnder ReviewOct 27, 2026, 7:58 PM 0.70.0Unknown—AllowUnder ReviewOct 25, 2026, 10:23 PM

registry / Malware / @fayz-ai/portal

@fayz-ai/portal

Fayz SDK member/learner portal scaffold — authenticated 'my courses' + player surface

This report shows the evidence for @fayz-ai/portal@0.69.0. 1 of 36 known versions is blocked or flagged. The newest version, 0.77.0, is allowed. See all versions.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Static reason

No blocking static signals were detected.

Trigger

Member session initialization, sign-in, or signup.

Impact

Creates enrollment records for courses the member did not individually select.

Mechanism

The bundle lists all published courses and calls the provider enrollment method for each using the member ID derived from their email.

Attack narrative

AI rationale

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

On authentication, the bundle enrolls the member in every published course by default.
Both session establishment and explicit signup call the enrollment path after authentication.

Evidence against

The manifest describes an authenticated member portal and has no install lifecycle hook.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 22.3 KB of source

Source & flagged code

3 flagged

dist/index.jsView file

High

Ai Review Evidence

On authentication, the bundle enrolls the member in every published course by default.

dist/index.jsView on unpkg · L66

High

Ai Review Evidence

Both session establishment and explicit signup call the enrollment path after authentication.

dist/index.jsView on unpkg · L78

package.jsonView file

Findings

3 High2 Low

HighAi Review Evidencedist/index.js

HighAi Review Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @fayz-ai/portal@0.69.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @fayz-ai/portal@0.69.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-25 19:24:45.103Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

36 known versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages