@lystech/core@3.0.127

⚠ Under review

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The inspected workflow is package-specific and its push-triggered disclosure requires a later repository event after the generated file is committed. Full review remains unresolved because some declared runtime dependency source could not be verified, so the package cannot be cleared from this inspection alone.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package runs the postinstall hook; the generated workflow later runs on a push to the main or master branch or by manual dispatch.

Impact

Repository metadata may reach the registry service after the workflow is committed and activated; full runtime dependency behavior could not be resolved from this inspection.

Mechanism

The hook writes a workflow that checks for this package and posts repository identity and package presence to the registry service.

AI rationale

Evidence

bin/postinstall.cjs.github/workflows/sync-package-registry.yml

Network endpoints1

lysbunback-usgg4.ondigitalocean.app/api/package-registry

Decision evidence

public snapshot

AI called this Manual Review at 73.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest runs a postinstall setup script; it skips if the opt-out is set or the consuming project does not declare this package.
The hook writes a registry-sync workflow that runs on later pushes or manual dispatch and sends repository identity and package presence to the package registry endpoint.
The reviewed setup code does not establish a direct network send during package installation; full runtime dependency behavior remains unresolved.

Evidence against

The generated workflow registers this package and only activates after a later repository event.
The hook prints instructions to commit and push the generated workflow, providing a user action before push-triggered disclosure.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetry

Source & flagged code

11 flagged

package.jsonView file

Lines 8-48json

8 "main": "dist/lystech-core-provider.umd.js",

9 "module": "dist/lystech-core-provider.es.js",

10 "types": "dist/index.d.ts",

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "dist",

16 "bin"

17 ],

18 "scripts": {

19 "test": "echo \"Error: no test specified\" && exit 1",

20 "build": "vite build",

21 "dev": "vite --config vite.config.dev.ts",

22 "demo": "vite --config vite.config.demo.ts",

23 "preview": "vite preview --config vite.config.dev.ts",

24 "deploy": "deploy.bat",

25 "check-pwa": "node ./bin/check-pwa.cjs",

26 "setup-github-action": "node ./bin/setup-github-action.cjs",

27 "setup-auto-update-workflow": "node ./bin/setup-github-action.cjs",

28 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "trigger-workflow": "git add -A && (git diff-index --quiet HEAD || git commit -m \"Update changes\") && git pull --rebase && git commit --allow-empty -m \"Trigger GitHub workflow\" && git push",

30 "sync:local": "npm run build && node scripts/sync-local-core.mjs"

31 },

32 "dependencies": {

33 "@lystech/sections": "^0.1.0",

34 "@mantine/core": "^8.1.3",

35 "@mantine/dates": "^8.1.3",

36 "@paypal/react-paypal-js": "^8.8.3",

37 "@phosphor-icons/react": "^2.1.10",

38 "@react-oauth/google": "^0.12.1",

39 "@tanstack/react-query": "^4.35.0",

40 "antd": "^5.12.8",

41 "axios": "^1.0.0",

42 "dompurify": "^3.4.11",

43 "firebase": "^9.9.4",

44 "jwt-decode": "^4.0.0",

45 "ldrs": "^1.1.9",

46 "moment": "^2.30.1",

47 "react-countup": "^6.5.3",

48 "vite-plugin-dts": "^4.5.4"

bin/check-pwa.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// Script universel de vérification PWA pour un projet Node.js (CommonJS)

4const fs = require("fs");

5const path = require("path");

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var m0;function h4(){return m0||(m0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Q}}var ae=!1,le;{var G=typeof WeakMap=="function"?WeakMap:Map;le=new G}function ne(Q,Ie){if(!Q||ae)return"";{var Le=le.get(Q);if(Le!==void 0)return Le}var oe;ae=!0;var Ne=Erro... ... L20: `),mt=We.length-1,wt=St.length-1;mt>=1&&wt>=0&&We[mt]!==St[wt];)wt--;for(;mt>=1&&wt>=0;mt--,wt--)if(We[mt]!==St[wt]){if(mt!==1||wt!==1)do if(mt--,wt--,wt<0||We[mt]!==St[wt]){var Ue... L21: `+We[mt].replace(" at new "," at ");return Q.displayName&&Ue.includes("<anonymous>")&&(Ue=Ue.replace("<anonymous>",Q.displayName)),typeof Q=="function"&&le.set(Q

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var m0;function h4(){return m0||(m0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ie+Q}}var ae=!1,le;{var G=typeof WeakMap=="function"?WeakMap:Map;le=new G}function ne(Q,Ie){if(!Q||ae)return"";{var Le=le.get(Q);if(Le!==void 0)return Le}var oe;ae=!0;var Ne=Erro... ... L20: `),mt=We.length-1,wt=St.length-1;mt>=1&&wt>=0&&We[mt]!==St[wt];)wt--;for(;mt>=1&&wt>=0;mt--,wt--)if(We[mt]!==St[wt]){if(mt!==1||wt!==1)do if(mt--,wt--,wt<0||We[mt]!==St[wt]){var Ue... L21: `+We[mt].replace(" at new "," at ");return Q.displayName&&Ue.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/check-pwa.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

Findings

3 Critical6 High5 Medium6 Low

CriticalCredential Exfiltrationdist/lystech-core-provider.umd.js

CriticalTrigger Reachable Dangerous Capabilitydist/lystech-core-provider.umd.js

CriticalPrevious Version Dangerous Deltadist/lystech-core-provider.umd.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationdist/lystech-core-provider.umd.js

HighKnown Malware Source Similaritybin/attach.cjs

HighKnown Malware Source Similaritybin/check-pwa.cjs

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/setup-registry.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

Medium

Affected versions and remediation

This report applies to @lystech/core@3.0.127.

See all versions of @lystech/core for other recorded verdicts.

Review the evidence and your use of @lystech/core@3.0.127 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 19:05:01.264Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.