registry / @fleetbo/svro / 0.0.12

@fleetbo/svro@0.0.12

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install-time code mutates the consuming project and adds a Vite middleware that can invoke a command. Runtime API calls send configured Fleetbo keys and requested data to Fleetbo Cloud Run services.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install; later Vite middleware requests or Fleetbo API calls.

Impact

Unexpected project configuration changes and an added development-server command-execution path.

Mechanism

postinstall project rewriting and schema-sync command execution

Rationale

Source confirms intrusive install-time mutation and a later command-execution path, warranting a warning. It does not establish malicious intent, covert exfiltration, or prohibited AI-agent control-surface modification.

Evidence

package.jsondist/postinstall.cjsdist/cli.cjssrc/index.jssrc/api.jsREADME.md.envtsconfig.jsonjsconfig.jsonvite.config.tsvite.config.jsvite.config.mjssvro.schema.jsonsrc/index.d.tssrc/auto-imports.d.ts

Network endpoints5

sendemailotp-jqycakhlxa-uc.a.run.appverifyemailotp-jqycakhlxa-uc.a.run.appadd-jqycakhlxa-uc.a.run.appdelete-jqycakhlxa-uc.a.run.app

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14586

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @fleetbo/svro (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

package.json runs dist/postinstall.cjs automatically.
dist/postinstall.cjs rewrites .env, package.json, ts/jsconfig, and vite.config during install.
The injected Vite middleware executes `npx fleetbo sql sync` on POST /__fleetbo_sync_schema.
src/api.js sends Fleetbo environment keys and caller data to Cloud Run endpoints.

Evidence against

OTP requests are interactive and skipped in non-TTY environments.
README.md explicitly documents the postinstall configuration and .env key setup.
No hidden credential harvesting, arbitrary shell command, remote payload loading, or AI-agent configuration writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

MinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 40.1 KB of source, external domains: sendemailotp-jqycakhlxa-uc.a.run.app, verifyemailotp-jqycakhlxa-uc.a.run.app

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node ./dist/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

1#!/usr/bin/env node L2: var I=(t,n)=>()=>{try{return n||t((n={exports:{}}).exports,n),n.exports}catch(o){throw n=0,o}};var j=I((L,_)=>{var a=require("fs"),p=require("path");function i(t){console.log(` ${... L3: `),i(`\u2192 ${p.basename(r)} ${s?"cr\xE9\xE9":"mis \xE0 jour"} : checkJs/jsx/types configur\xE9s.`),i(' \u26A0\uFE0F Rechargez votre \xE9diteur si les changements ne sont pas pr... ... L22: const path = require('path'); L23: const { execSync } = require('child_process'); L24: const schemaPath = path.join(process.cwd(), 'svro.schema.json'); L25: fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); ... L28: res.writeHead(200, { 'Content-Type': 'application/json' }); L29: res.end(JSON.stringify({ success: true })); L30: } catch (e) { ... L40: },`+s.slice(c)}}i

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/postinstall.jsView on unpkg · L1

25fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L26: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L27: } L28: res.writeHead(200, { 'Content-Type': 'application/json' }); L29: res.end(JSON.stringify({ success: true })); L30: } catch (e) { ... L40: },`+s.slice(c)}}if(s!==r)try{a.writeFileSync(l,s),i(`\u2192 ${p.basename(l)} patch\xE9 : plugins AutoImport & Fleetbo Schema Sync configur\xE9s.`)}catch{i("\u2192 \xC9chec de l'\xE... L41: `),i("\u2192 package.json mis \xE0 jour : unplugin-auto-import ajout\xE9 aux devDependencies."),i(" \u26A0\uFE0F Relancez `npm install` une fois pour installer le paquet ajout\xE... L42: VITE_FLEETBO_DB_KEY=${e.dbKey}

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/postinstall.jsView on unpkg · L25

22const path = require('path'); L23: const { execSync } = require('child_process'); L24: const schemaPath = path.join(process.cwd(), 'svro.schema.json');

High

Child Process

Package source references child process execution.

dist/postinstall.jsView on unpkg · L22

25fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L26: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L27: } ... L40: },`+s.slice(c)}}if(s!==r)try{a.writeFileSync(l,s),i(`\u2192 ${p.basename(l)} patch\xE9 : plugins AutoImport & Fleetbo Schema Sync configur\xE9s.`)}catch{i("\u2192 \xC9chec de l'\xE... L41: `),i("\u2192 package.json mis \xE0 jour : unplugin-auto-import ajout\xE9 aux devDependencies."),i(" \u26A0\uFE0F Relancez `npm install` une fois pour installer le paquet ajout\xE... L42: VITE_FLEETBO_DB_KEY=${e.dbKey}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/postinstall.jsView on unpkg · L25

25fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L26: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L27: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/postinstall.jsView on unpkg · L25

dist/postinstall.cjsView file

1Trigger-reachable chain: scripts.postinstall -> dist/postinstall.cjs L1: #!/usr/bin/env node L2: var I=(t,n)=>()=>{try{return n||t((n={exports:{}}).exports,n),n.exports}catch(o){throw n=0,o}};var j=I((L,_)=>{var a=require("fs"),p=require("path");function i(t){console.log(` ${... L3: `),i(`\u2192 ${p.basename(r)} ${s?"cr\xE9\xE9":"mis \xE0 jour"} : checkJs/jsx/types configur\xE9s.`),i(' \u26A0\uFE0F Rechargez votre \xE9diteur si les changements ne sont pas pr... ... L22: const path = require('path'); L23: const { execSync } = require('child_process'); L24: const schemaPath = path.join(process.cwd(), 'svro.schema.json'); L25: fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); ... L28: res.writeHead(200, { 'Content-Type': 'application/json' }); L29: res.end(JSON.stringi

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/postinstall.cjsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @fleetbo/svro@0.0.9 matchedIdentity = npm:QGZsZWV0Ym8vc3Zybw:0.0.9 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/postinstall.cjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

Findings

4 Critical5 High4 Medium5 Low

CriticalCredential Exfiltrationdist/postinstall.js

CriticalCommand Output Exfiltrationdist/postinstall.js

CriticalTrigger Reachable Dangerous Capabilitydist/postinstall.cjs

CriticalPrevious Version Dangerous Deltadist/postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/postinstall.js

HighShell

HighSame File Env Network Executiondist/postinstall.js

HighRuntime Package Installdist/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

Medium