registry / Install hook abuse / @lystech/core / 3.0.130

@lystech/core@3.0.130

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The package's postinstall creates a consumer workflow that performs recurring registry synchronization without an affirmative setup step. Because the inspected payload is repository metadata and the behavior is package-related, the evidence supports a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package in a project that declares @lystech/core as a dependency, when the postinstall hook runs.

Impact

The consumer project gains recurring CI activity and shares repository identifiers without an affirmative setup step.

Mechanism

The hook writes a workflow that runs on pushes to main or master and can also be started manually; it queries GitHub for the repository ID and posts repository identifiers to the Lystech registry.

AI rationale

Evidence

package.jsonbin/postinstall.cjs.github/workflows/sync-package-registry.yml

Network endpoints2

api.github.com/repos/$OWNER/$REPO_NAMElysbunback-usgg4.ondigitalocean.app/api/package-registry

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs bin/postinstall.cjs during installation.
The postinstall checks whether the consumer project declares @lystech/core, then creates a workflow that runs on pushes to main or master.
The workflow queries GitHub for the repository ID and sends the package name, owner, repository name, and ID to the Lystech registry endpoint.
The postinstall writes the workflow into the consumer project's .github/workflows directory.

Evidence against

The workflow is for syncing @lystech/core package registration, and the inspected payload contains repository identifiers rather than credentials.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

10 flagged

package.jsonView file

Lines 8-48json

8 "main": "dist/lystech-core-provider.umd.js",

9 "module": "dist/lystech-core-provider.es.js",

10 "types": "dist/index.d.ts",

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "dist",

16 "bin"

17 ],

18 "scripts": {

19 "test": "echo \"Error: no test specified\" && exit 1",

20 "build": "vite build",

21 "dev": "vite --config vite.config.dev.ts",

22 "demo": "vite --config vite.config.demo.ts",

23 "preview": "vite preview --config vite.config.dev.ts",

24 "deploy": "deploy.bat",

25 "check-pwa": "node ./bin/check-pwa.cjs",

26 "setup-github-action": "node ./bin/setup-github-action.cjs",

27 "setup-auto-update-workflow": "node ./bin/setup-github-action.cjs",

28 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "trigger-workflow": "git add -A && (git diff-index --quiet HEAD || git commit -m \"Update changes\") && git pull --rebase && git commit --allow-empty -m \"Trigger GitHub workflow\" && git push",

30 "sync:local": "npm run build && node scripts/sync-local-core.mjs"

31 },

32 "dependencies": {

33 "@lystech/sections": "^0.1.0",

34 "@mantine/core": "^8.1.3",

35 "@mantine/dates": "^8.1.3",

36 "@paypal/react-paypal-js": "^8.8.3",

37 "@phosphor-icons/react": "^2.1.10",

38 "@react-oauth/google": "^0.12.1",

39 "@tanstack/react-query": "^4.35.0",

40 "antd": "^5.12.8",

41 "axios": "^1.0.0",

42 "dompurify": "^3.4.11",

43 "firebase": "^9.9.4",

44 "jwt-decode": "^4.0.0",

45 "ldrs": "^1.1.9",

46 "moment": "^2.30.1",

47 "react-countup": "^6.5.3",

48 "vite-plugin-dts": "^4.5.4"

bin/check-pwa.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/check-pwa.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

3// Script universel de vérification PWA pour un projet Node.js (CommonJS) L4: const fs = require("fs"); L5: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/check-pwa.cjsView on unpkg · L3

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var v0;function v4(){return v0||(v0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+re+Z}}var ae=!1,se;{var $=typeof WeakMap=="function"?WeakMap:Map;se=new $}function G(Z,Pe){if(!Z||ae)return"";{var Le=se.get(Z);if(Le!==void 0)return Le}var Be;ae=!0;var ct=Error... ... L20: `),Qe=Ie.length-1,st=Ve.length-1;Qe>=1&&st>=0&&Ie[Qe]!==Ve[st];)st--;for(;Qe>=1&&st>=0;Qe--,st--)if(Ie[Qe]!==Ve[st]){if(Qe!==1||st!==1)do if(Qe--,st--,st<0||Ie[Qe]!==Ve[st]){var je... L21: `+Ie[Qe].replace(" at new "," at ");return Z.displayName&&je.includes("<anonymous>")&&(je=je.replace("<anonymous>",Z.displayName)),typeof Z=="function"&&se.set(Z

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var v0;function v4(){return v0||(v0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+re+Z}}var ae=!1,se;{var $=typeof WeakMap=="function"?WeakMap:Map;se=new $}function G(Z,Pe){if(!Z||ae)return"";{var Le=se.get(Z);if(Le!==void 0)return Le}var Be;ae=!0;var ct=Error... ... L20: `),Qe=Ie.length-1,st=Ve.length-1;Qe>=1&&st>=0&&Ie[Qe]!==Ve[st];)st--;for(;Qe>=1&&st>=0;Qe--,st--)if(Ie[Qe]!==Ve[st]){if(Qe!==1||st!==1)do if(Qe--,st--,st<0||Ie[Qe]!==Ve[st]){var je... L21: `+Ie[Qe].replace(" at new "," at ");return Z.displayName&&je.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

Findings

2 Critical6 High5 Medium6 Low

CriticalCredential Exfiltrationdist/lystech-core-provider.umd.js

CriticalTrigger Reachable Dangerous Capabilitydist/lystech-core-provider.umd.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationdist/lystech-core-provider.umd.js

HighKnown Malware Source Similaritybin/attach.cjs

HighKnown Malware Source Similaritybin/check-pwa.cjs

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/setup-registry.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/check-pwa.cjs

MediumNetwork

Affected versions and remediation

This report applies to @lystech/core@3.0.130.

See all versions of @lystech/core for other recorded verdicts.

Review the evidence and your use of @lystech/core@3.0.130 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-21 19:43:12.704Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.