Loading npm security reports…

@lystech/core@3.0.106: Malicious npm security report (Block) | LPM Firewall

registry / @lystech/core / 3.0.106

@lystech/core@3.0.106

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package creates a GitHub Actions workflow in the consuming project without an explicit command. The workflow persists on future pushes and reports repository metadata to an external service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation in a project that lists @lystech/core as a dependency.

Impact

The package silently modifies the consumer's CI control surface and establishes persistent external reporting.

Mechanism

Postinstall CI workflow injection and repository metadata reporting.

Attack narrative

During installation, the manifest executes the postinstall script in the consumer project. It creates .github/workflows/sync-package-registry.yml unless an opt-out variable is set. On later pushes, that workflow reads repository identifiers using the GitHub token and posts the package name and repository metadata to an external DigitalOcean service. This creates unrequested, persistent CI behavior beyond the package directory.

Rationale

The package performs unconsented postinstall mutation of a consumer repository and installs persistent workflow code that reports repository metadata externally. This is concrete unwanted persistence, not merely a static scanner signal.

Evidence

package.jsonbin/postinstall.cjs.github/workflows/sync-package-registry.yml

Network endpoints2

api.github.com/repos/$OWNER/$REPO_NAME/api/package-registry

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var rp;function G8(){return rp||(rp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var oe=!1,ce;{var G=typeof WeakMap=="function"?WeakMap:Map;ce=new G}function re(Z,ee){if(!Z||oe)return"";{var Ce=ce.get(Z);if(Ce!==void 0)return Ce}var Oe;oe=!0;var Te=Erro... ... L20: `),Et=tt.length-1,xt=Lt.length-1;Et>=1&&xt>=0&&tt[Et]!==Lt[xt];)xt--;for(;Et>=1&&xt>=0;Et--,xt--)if(tt[Et]!==Lt[xt]){if(Et!==1||xt!==1)do if(Et--,xt--,xt<0||tt[Et]!==Lt[xt]){var Be... L21: `+tt[Et].replace(" at new "," at ");return Z.displayName&&Be.includes("<anonymous>")&&(Be=Be.replace("<anonymous>",Z.displayName)),typeof Z=="function"&&ce.set(Z

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var rp;function G8(){return rp||(rp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var oe=!1,ce;{var G=typeof WeakMap=="function"?WeakMap:Map;ce=new G}function re(Z,ee){if(!Z||oe)return"";{var Ce=ce.get(Z);if(Ce!==void 0)return Ce}var Oe;oe=!0;var Te=Erro... ... L20: `),Et=tt.length-1,xt=Lt.length-1;Et>=1&&xt>=0&&tt[Et]!==Lt[xt];)xt--;for(;Et>=1&&xt>=0;Et--,xt--)if(tt[Et]!==Lt[xt]){if(Et!==1||xt!==1)do if(Et--,xt--,xt<0||tt[Et]!==Lt[xt]){var Be... L21: `+tt[Et].replace(" at new "," at ");return Z.displayName&&Be.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lystech-core-provider.umd.jsView on unpkg · L16

1700patternName = google_api_key severity = high line = 1700 matchedText = }`;funct...nce.

High

High Secret

Package contains a high-severity secret pattern.

dist/lystech-core-provider.umd.jsView on unpkg · L1700

16Trigger-reachable credential exfiltration chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var rp;function G8(){return rp||(rp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var oe=!1,ce;{var G=typeof WeakMap=="function"?WeakMap:Map;ce=new G}function re(Z,ee){if(!Z||oe)return"";{var Ce=ce.get(Z);if(Ce!==void 0)return Ce}var Oe;oe=!0;var Te=Erro... ... L20: `),Et=tt.length-1,xt=Lt.length-1;Et>=1&&xt>=0&&tt[Et]!==Lt[xt];)xt--;for(;Et>=1&&xt>=0;Et--,xt--)if(tt[Et]!==Lt[xt]){if(Et!==1||xt!==1)do if(Et--,xt--,xt<0||tt[Et]!==Lt[xt]){var Be... L21: `+tt[Et].replace(" at new "," at ");return Z.displayName&&Be.

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/lystech-core-provider.umd.jsView on unpkg · L16

1700patternName = google_api_key severity = high line = 1700 matchedText = }`;funct...nce.

High

Secret Pattern

Google API key in dist/lystech-core-provider.umd.js

dist/lystech-core-provider.umd.jsView on unpkg · L1700

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1f6636f292abbc0b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @lystech/core@3.0.105 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/attach.cjsView on unpkg

bin/check-pwa.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/check-pwa.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 8-48json

8 "main": "dist/lystech-core-provider.umd.js",

9 "module": "dist/lystech-core-provider.es.js",

10 "types": "dist/index.d.ts",

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "dist",

16 "bin"

17 ],

18 "scripts": {

19 "test": "echo \"Error: no test specified\" && exit 1",

20 "build": "vite build",

21 "dev": "vite --config vite.config.dev.ts",

22 "demo": "vite --config vite.config.demo.ts",

23 "preview": "vite preview --config vite.config.dev.ts",

24 "deploy": "deploy.bat",

25 "check-pwa": "node ./bin/check-pwa.cjs",

26 "setup-github-action": "node ./bin/setup-github-action.cjs",

27 "setup-auto-update-workflow": "node ./bin/setup-github-action.cjs",

28 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "trigger-workflow": "git add -A && (git diff-index --quiet HEAD || git commit -m \"Update changes\") && git pull --rebase && git commit --allow-empty -m \"Trigger GitHub workflow\" && git push",

30 "sync:local": "npm run build && node scripts/sync-local-core.mjs"

31 },

32 "dependencies": {

33 "@mantine/core": "^8.1.3",

34 "@mantine/dates": "^8.1.3",

35 "@paypal/react-paypal-js": "^8.8.3",

36 "@phosphor-icons/react": "^2.1.10",

37 "@react-oauth/google": "^0.12.1",

38 "@tanstack/react-query": "^4.35.0",

39 "antd": "^5.12.8",

40 "axios": "^1.0.0",

41 "dompurify": "^3.4.11",

42 "firebase": "^9.9.4",

43 "jwt-decode": "^4.0.0",

44 "ldrs": "^1.1.9",

45 "moment": "^2.30.1",

46 "react-countup": "^6.5.3",

47 "vite-plugin-dts": "^4.5.4"

48 },

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var rp;function G8(){return rp||(rp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var oe=!1,ce;{var G=typeof WeakMap=="function"?WeakMap:Map;ce=new G}function re(Z,ee){if(!Z||oe)return"";{var Ce=ce.get(Z);if(Ce!==void 0)return Ce}var Oe;oe=!0;var Te=Erro... ... L20: `),Et=tt.length-1,xt=Lt.length-1;Et>=1&&xt>=0&&tt[Et]!==Lt[xt];)xt--;for(;Et>=1&&xt>=0;Et--,xt--)if(tt[Et]!==Lt[xt]){if(Et!==1||xt!==1)do if(Et--,xt--,xt<0||tt[Et]!==Lt[xt]){var Be... L21: `+tt[Et].replace(" at new "," at ");return Z.displayName&&Be.includes("<anonymous>")&&(Be=Be.replace("<anonymous>",Z.displayName)),typeof Z=="function"&&ce.set(Z

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var rp;function G8(){return rp||(rp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var oe=!1,ce;{var G=typeof WeakMap=="function"?WeakMap:Map;ce=new G}function re(Z,ee){if(!Z||oe)return"";{var Ce=ce.get(Z);if(Ce!==void 0)return Ce}var Oe;oe=!0;var Te=Erro... ... L20: `),Et=tt.length-1,xt=Lt.length-1;Et>=1&&xt>=0&&tt[Et]!==Lt[xt];)xt--;for(;Et>=1&&xt>=0;Et--,xt--)if(tt[Et]!==Lt[xt]){if(Et!==1||xt!==1)do if(Et--,xt--,xt<0||tt[Et]!==Lt[xt]){var Be... L21: `+tt[Et].replace(" at new "," at ");return Z.displayName&&Be.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1f6636f292abbc0b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @lystech/core@3.0.105 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 shingleOverlap = 7 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/attach.cjsView on unpkg

bin/check-pwa.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/check-pwa.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.105 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.105 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg