registry / @gogovega/firebase-config-node / 0.4.0

@gogovega/firebase-config-node@0.4.0

Node-RED config node to communicate with Google Firebase

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package runs a remote shell script without user action. The fetched content can change independently of the published package.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation invokes the postinstall lifecycle hook.

Impact

A remote party can run arbitrary commands with the installing user's privileges.

Mechanism

Downloads a remote script and executes it through bash.

Attack narrative

During npm installation, package.json launches scripts/axios-check.js. That file uses child_process.exec to fetch a shell script from a mutable raw GitHub branch and pipe it to bash. The package does not pin, bundle, or verify that code, so its publisher or the remote repository can cause arbitrary commands to run on every installation.

Rationale

The automatic postinstall remote-code execution is a concrete supply-chain attack surface, not a user-invoked feature. Its mutable unverified payload warrants blocking publication.

Evidence

package.jsonscripts/axios-check.js

Network endpoints1

raw.githubusercontent.com/theNetworkChuck/axios-attack-guide/refs/heads/main/check.sh

Decision evidence

public snapshot

with false-positive risk.

@gogovega/firebase-config-node@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code