registry / Install hook abuse / @lystech/core / 3.0.125

@lystech/core@3.0.125

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Source inspection confirms an automatic postinstall mutation and later repository metadata transmission to the package registry. The behavior appears limited to registry synchronization, so the evidence supports a warning rather than a malicious block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with a consumer project that depends on @lystech/core, unless SKIP_LYSTECH_SETUP=true is set.

Impact

Consumer project files are modified automatically, and repository owner, name, and ID can be sent on later workflow runs.

Mechanism

The postinstall writes a GitHub Actions workflow that registers or removes the repository in the package registry.

AI rationale

Evidence

package.jsonbin/postinstall.cjsdist/lystech-core-provider.umd.js.github/workflows/sync-package-registry.yml

Network endpoints2

lysbunback-usgg4.ondigitalocean.app/api/package-registryapi.lystech.ca/api/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs bin/postinstall.cjs automatically during installation.
The postinstall writes a workflow into the consumer repository; the only shown opt-out is SKIP_LYSTECH_SETUP=true.
That workflow sends repository owner, name, and ID to the package registry when it runs.

Evidence against

The workflow is limited to package registry synchronization, and it skips creating a workflow when one already exists.
The inspected bundle request targets the package-aligned api.lystech.ca service; the scanner's authorization match is consistent with ordinary request headers.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

3// Script universel de vérification PWA pour un projet Node.js (CommonJS) L4: const fs = require("fs"); L5: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/check-pwa.cjsView on unpkg · L3

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var fp;function l4(){return fp||(fp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var ae=!1,le;{var G=typeof WeakMap=="function"?WeakMap:Map;le=new G}function ne(Z,Ie){if(!Z||ae)return"";{var Le=le.get(Z);if(Le!==void 0)return Le}var oe;ae=!0;var Me=Erro... ... L20: `),mt=We.length-1,wt=St.length-1;mt>=1&&wt>=0&&We[mt]!==St[wt];)wt--;for(;mt>=1&&wt>=0;mt--,wt--)if(We[mt]!==St[wt]){if(mt!==1||wt!==1)do if(mt--,wt--,wt<0||We[mt]!==St[wt]){var Ue... L21: `+We[mt].replace(" at new "," at ");return Z.displayName&&Ue.includes("<anonymous>")&&(Ue=Ue.replace("<anonymous>",Z.displayName)),typeof Z=="function"&&le.set(Z

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var fp;function l4(){return fp||(fp=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Z}}var ae=!1,le;{var G=typeof WeakMap=="function"?WeakMap:Map;le=new G}function ne(Z,Ie){if(!Z||ae)return"";{var Le=le.get(Z);if(Le!==void 0)return Le}var oe;ae=!0;var Me=Erro... ... L20: `),mt=We.length-1,wt=St.length-1;mt>=1&&wt>=0&&We[mt]!==St[wt];)wt--;for(;mt>=1&&wt>=0;mt--,wt--)if(We[mt]!==St[wt]){if(mt!==1||wt!==1)do if(mt--,wt--,wt<0||We[mt]!==St[wt]){var Ue... L21: `+We[mt].replace(" at new "," at ");return Z.displayName&&Ue.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lystech-core-provider.umd.jsView on unpkg · L16

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.122 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.122 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.122 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

3// Script universel de vérification PWA pour un projet Node.js (CommonJS) L4: const fs = require("fs"); L5: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/check-pwa.cjsView on unpkg · L3

Findings

2 Critical5 High5 Medium6 Low

CriticalCredential Exfiltrationdist/lystech-core-provider.umd.js

CriticalTrigger Reachable Dangerous Capabilitydist/lystech-core-provider.umd.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationdist/lystech-core-provider.umd.js

HighKnown Malware Source Similaritybin/attach.cjs

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/setup-registry.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/check-pwa.cjs

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to @lystech/core@3.0.125.

See all versions of @lystech/core for other recorded verdicts.

Review the evidence and your use of @lystech/core@3.0.125 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 17:14:23.072Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.