@lystech/core@3.0.136

⚠ Under review

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 23h ago · by lpm-firewall-ai

The inspected bundle routes API requests to the Lystech service and gates Firebase token synchronization on a configured endpoint. Unresolved selected runtime dependencies prevent a clean verdict, so this requires review.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

No confirmed malicious trigger; the manifest declares runtime dependencies whose selected source was not available for review.

Impact

The inspected source does not establish an attack, but unavailable dependency source prevents a clean determination.

Mechanism

The package includes a postinstall workflow-creation branch, guarded by a check for the current package manifest, and a Firebase token-sync path that activates only when an endpoint is configured.

AI rationale

Evidence

package.jsonbin/postinstall.cjsdist/lystech-core-provider.umd.js

Decision evidence

public snapshot

AI called this Manual Review at 81.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares unresolved runtime dependencies on @mantine/core and firebase, so their selected source could not be reviewed.
The postinstall hook exits when the current manifest identifies the package as @lystech/core; its other branch writes a workflow file.
The inspected bundle uses the Lystech API as its default API base and only enables Firebase token sync when an authTokenSyncURL is configured.

Evidence against

The inspected source does not establish credential transfer to an unrelated recipient or another confirmed attack.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 4.34 MB of source, external domains: accounts.google.com, ant.design, api.github.com, api.lystech.ca, apis.google.com, github.com, lysbunback-usgg4.ondigitalocean.app, lystech.firebaseio.com, momentjs.com, placehold.co, react-query.tanstack.com, reactjs.org, u.ant.design, www.google.com, www.paypal.com, www.sandbox.paypal.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/check-pwa.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

3// Script universel de vérification PWA pour un projet Node.js (CommonJS) L4: const fs = require("fs"); L5: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/check-pwa.cjsView on unpkg · L3

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var p0;function S4(){return p0||(p0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ne+Q}}var ae=!1,se;{var $=typeof WeakMap=="function"?WeakMap:Map;se=new $}function ie(Q,Ie){if(!Q||ae)return"";{var Fe=se.get(Q);if(Fe!==void 0)return Fe}var He;ae=!0;var rt=Erro... ... L20: `),Et=ut.length-1,pe=Ht.length-1;Et>=1&&pe>=0&&ut[Et]!==Ht[pe];)pe--;for(;Et>=1&&pe>=0;Et--,pe--)if(ut[Et]!==Ht[pe]){if(Et!==1||pe!==1)do if(Et--,pe--,pe<0||ut[Et]!==Ht[pe]){var Ae... L21: `+ut[Et].replace(" at new "," at ");return Q.displayName&&Ae.includes("<anonymous>")&&(Ae=Ae.replace("<anonymous>",Q.displayName)),typeof Q=="function"&&se.set(Q

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var p0;function S4(){return p0||(p0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ne+Q}}var ae=!1,se;{var $=typeof WeakMap=="function"?WeakMap:Map;se=new $}function ie(Q,Ie){if(!Q||ae)return"";{var Fe=se.get(Q);if(Fe!==void 0)return Fe}var He;ae=!0;var rt=Erro... ... L20: `),Et=ut.length-1,pe=Ht.length-1;Et>=1&&pe>=0&&ut[Et]!==Ht[pe];)pe--;for(;Et>=1&&pe>=0;Et--,pe--)if(ut[Et]!==Ht[pe]){if(Et!==1||pe!==1)do if(Et--,pe--,pe<0||ut[Et]!==Ht[pe]){var Ae... L21: `+ut[Et].replace(" at new "," at ");return Q.displayName&&Ae.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

Findings

2 Critical6 High5 Medium6 Low

CriticalCredential Exfiltrationdist/lystech-core-provider.umd.js

CriticalTrigger Reachable Dangerous Capabilitydist/lystech-core-provider.umd.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationdist/lystech-core-provider.umd.js

HighKnown Malware Source Similaritybin/attach.cjs

HighKnown Malware Source Similaritybin/check-pwa.cjs

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/setup-registry.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/check-pwa.cjs

MediumNetwork

Affected versions and remediation

This report applies to @lystech/core@3.0.136.

See all versions of @lystech/core for other recorded verdicts.

Review the evidence and your use of @lystech/core@3.0.136 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 04:32:29.209Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.