@kingingwang/grok@1.0.38-3662b885: Clean npm security report | LPM Firewall

Loading npm security reports…

@kingingwang/grok@1.0.38-3662b885: Clean npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

21"scripts": { "postinstall": "node bin/postinstall.js" },

Low

Suspicious Lifecycle Evidence

The manifest's only lifecycle hook runs the local postinstall script.

package.jsonView on unpkg · L21

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 830396dc7d8ac054 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/postinstall.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/postinstall.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @kingingwang/grok@1.0.12-8d051d60 matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.12-8d051d60 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.jsView on unpkg

181const platformDir = resolvePlatformPackageDir(); if (!platformDir) { console.error(`@kingingwang/grok: platform package @kingingwang/grok-${key} not installed.`); console.error(' This usually means npm was invoked with --no-optional, or the install failed.'); console.error(' Try: npm install -g @kingingwang/grok'); process.exit(0);

Low

Suspicious Lifecycle Evidence

The postinstall script resolves a matching platform optional dependency and installs its grok binary locally.

bin/postinstall.jsView on unpkg · L181

bin/grok-bootstrap.jsView file

•matchType = normalized_sha256 matchedPackage = @kingingwang/grok@1.0.32-aae58918 matchedPath = bin/grok-bootstrap.js matchedIdentity = npm:QGtpbmdpbmd3YW5nL2dyb2s:1.0.32-aae58918 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/grok-bootstrap.jsView on unpkg

133const execPath = resolveBinary(); const childEnv = { ...process.env, GROK_MANAGED_BY_NPM: '1' }; const child = spawn(execPath, process.argv.slice(2), { stdio: 'inherit', env: childEnv });

Low

Ai Review Evidence

The bootstrap launcher only spawns the resolved binary with caller-supplied arguments and inherited standard I/O.

bin/grok-bootstrap.jsView on unpkg · L133