registry / @fleetbo/svro / 0.0.6

@fleetbo/svro@0.0.6

- @fleetbo/svro (V0)

AI Security Review

scanned 15h ago · by lpm-firewall-ai

Installation performs interactive Fleetbo account setup and broad project-configuration edits. No confirmed stealth payload, exfiltration chain, or AI-agent control-surface mutation exists.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install in an interactive terminal; runtime Fleetbo API method calls.

Impact

Writes Fleetbo credentials and alters build/configuration files in the installing project.

Mechanism

postinstall credential provisioning and project-file patching

Rationale

Source supports a documented Fleetbo setup workflow, not a concrete malicious chain. Its postinstall nonetheless performs significant project and credential configuration, so it warrants a warning.

Evidence

package.jsonscripts/postinstall.jssrc/index.jssrc/api.jsbin/cli.jsREADME.md.envsvro.schema.jsonsvro.d.tstsconfig.jsonjsconfig.jsonvite.config.tsvite.config.jsvite.config.mjssrc/index.d.ts

Network endpoints10

sendemailotp-jqycakhlxa-uc.a.run.appverifyemailotp-jqycakhlxa-uc.a.run.app

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs scripts/postinstall.js on install.
postinstall prompts for email and OTP, then sends both to Fleetbo Cloud Run endpoints.
postinstall appends returned credentials to the host project's .env.
postinstall rewrites project package.json, ts/js config, and Vite config.

Evidence against

The credential exchange is interactive, skipped in non-TTY environments, and documented in README.md.
No shell execution, remote-code loading, credential harvesting beyond prompted values, or AI-agent configuration writes were found.
Runtime network calls implement the documented Fleetbo data API using Fleetbo-named environment keys.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 16.8 KB of source, external domains: sendemailotp-jqycakhlxa-uc.a.run.app, verifyemailotp-jqycakhlxa-uc.a.run.app

Source & flagged code

3 flagged

package.jsonView file

Lines 1-19json

1{

2 "name": "@fleetbo/svro",

3 "version": "0.0.6",

4 "main": "src/index.js",

5 "types": "src/index.d.ts",

6 "bin": {

7 "fleetbo": "./bin/cli.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "bin",

14 "scripts",

15 "src",

16 "README.md"

17 ]

18}

19

scripts/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fleetbo/svro@0.0.5 matchedIdentity = npm:QGZsZWV0Ym8vc3Zybw:0.0.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fleetbo/svro@0.0.5 matchedIdentity = npm:QGZsZWV0Ym8vc3Zybw:0.0.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.js

Findings

2 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltascripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

add-jqycakhlxa-uc.a.run.app

addwithid-jqycakhlxa-uc.a.run.app

addwithuserid-jqycakhlxa-uc.a.run.app

delete-jqycakhlxa-uc.a.run.app

getdocsg-jqycakhlxa-uc.a.run.app

getdocsu-jqycakhlxa-uc.a.run.app

getauthuser-jqycakhlxa-uc.a.run.app

getdoc-jqycakhlxa-uc.a.run.app

View on unpkg

EnvironmentVars

Filesystem

Network

HighEntropyStrings

UrlStrings

NoLicense

LPM CLI

Source & flagged code

3 flagged

package.jsonView file

Lines 1-19json

1{

2 "name": "@fleetbo/svro",

3 "version": "0.0.6",

4 "main": "src/index.js",

5 "types": "src/index.d.ts",

6 "bin": {

7 "fleetbo": "./bin/cli.js"

8 },

9 "scripts": {

10 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "bin",

14 "scripts",

15 "src",

16 "README.md"

17 ]

18}

19

scripts/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fleetbo/svro@0.0.5 matchedIdentity = npm:QGZsZWV0Ym8vc3Zybw:0.0.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg