registry / @firestitch/component-tools / 18.0.18

@firestitch/component-tools@18.0.18

@firestitch/component-tools

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package mutates the consumer project's editor configuration and Git repository. It can commit and push those changes without user interaction.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs the postinstall lifecycle hook.

Impact

Consumer editor settings can be destroyed; the consumer repository can receive and publish an unwanted commit.

Mechanism

Install-time deletion and replacement of .vscode plus Git commit and push commands.

Attack narrative

On installation, postinstall.js resolves the consumer project three directories above its working directory. It removes that project's .vscode Git submodule, runs git rm, creates a commit, pushes to the configured remote, then recursively deletes and replaces .vscode. These are unconsented install-time mutations of a foreign project and its repository.

AI rationale

This is a concrete install-hook abuse chain affecting the consumer's files and Git remote. The editor settings are benign-looking, but they do not justify destructive deletion, commit, and push during dependency installation.

Evidence

package.jsonpostinstall.jslibs/env.js.vscode.git

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

@firestitch/component-tools@18.0.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code