@kingingwang/grok@1.0.10-6f4ddbd: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@kingingwang/grok@1.0.10-6f4ddbd: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

21"scripts": { "postinstall": "node bin/postinstall.js" }

Medium

Suspicious Lifecycle Evidence

The automatic postinstall hook installs a platform binary into the user's .grok directory.

package.jsonView on unpkg · L21

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.6-97098a6 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.6-97098a6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 910c1c41e996f4e3 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kingingwang/grok@1.0.6-97098a6 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.6-97098a6 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.jsView on unpkg

66fs.mkdirSync(CANONICAL_DIR, { recursive: true }); function writeVendorBinary(brPath, rawPath, destPath) { const tmp = destPath + `.tmp.${process.pid}`; try { if (fs.existsSync(brPath)) { fs.writeFileSync(tmp, zlib.brotliDecompressSync(fs.readFileSync(brPath))); } else if (fs.existsSync(rawPath)) { fs.copyFileSync(rawPath, tmp); } else { return false; } if (!IS_WINDOWS) fs.chmodSync(tmp, 0o755); fs.renameSync(tmp, destPath);

Medium

Suspicious Lifecycle Evidence

The automatic postinstall hook installs a platform binary into the user's .grok directory.

bin/postinstall.jsView on unpkg · L66

193// Write installer config const configDir = GROK_HOME; const configPath = path.join(configDir, 'config.toml'); let obj = {}; try { obj = TOML.parse(fs.readFileSync(configPath, 'utf8')); } catch { } obj.cli ??= {}; obj.cli.installer = 'npm'; // Persist the npm registry so `grok update` and the trampoline use the same one. const npmRegistry = process.env.GROK_NPM_REGISTRY || (() => { try { const resolved = execSync( 'npm config get @kingingwang:registry', { encoding: 'utf8', timeout: 5000 } ).trim(); if (resolved &&

Medium

Ai Review Evidence

The installer updates .grok/config.toml and records an npm registry setting.

bin/postinstall.jsView on unpkg · L193

bin/grokView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.6-97098a6 matchedPath = bin/grok matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.6-97098a6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grokView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-42json

1{

2 "name": "@kingingwang/grok",

3 "version": "1.0.10-6f4ddbd",

4 "description": "Bring Grok into your terminal",

5 "license": "Apache-2.0",

6 "bin": {

7 "grok": "bin/grok"

8 },

9 "files": [

10 "bin/"

11 ],

12 "os": [

13 "darwin",

14 "linux",

15 "win32"

16 ],

17 "cpu": [

18 "arm64",

19 "x64"

20 ],

21 "scripts": {

22 "postinstall": "node bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

Medium

Suspicious Lifecycle Evidence

The automatic postinstall hook installs a platform binary into the user's .grok directory.

package.jsonView on unpkg · L21

24 "publishConfig": {

25 "access": "public"

26 },

27 "engines": {

28 "node": ">=20"

29 },

30 "dependencies": {

31 "@iarna/toml": "^3.0.0"

32 },

33 "optionalDependencies": {

34 "@kingingwang/grok-darwin-arm64": "1.0.10-6f4ddbd",

35 "@kingingwang/grok-darwin-x64": "1.0.10-6f4ddbd",

36 "@kingingwang/grok-linux-arm64": "1.0.10-6f4ddbd",

37 "@kingingwang/grok-linux-x64": "1.0.10-6f4ddbd",

38 "@kingingwang/grok-win32-arm64": "1.0.10-6f4ddbd",

39 "@kingingwang/grok-win32-x64": "1.0.10-6f4ddbd"

40 }

41}

42

bin/postinstall.jsView file

Lines 46-86javascript

46// likely invoked with --no-optional or the platform is unsupported.

47function resolvePlatformPackageDir() {

48 const platformPkg = `@kingingwang/grok-${key}`;

49 try {

50 return path.

bin/grokView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.6-97098a6 matchedPath = bin/grok matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.6-97098a6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grokView on unpkg