registry / Data exfiltration / @lystech/core / 3.0.137

@lystech/core@3.0.137

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Source inspection found automatic collection and transmission of session-linked application events, including entered checkout email addresses, without an evident opt-in. The destination is the package’s configured Lystech API, so the evidence supports a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The application initializes the provider and a user interacts with the checkout form or a client error occurs.

Impact

Shopper email addresses and session-linked interaction data may be disclosed to the API without a clear user opt-in.

Mechanism

The provider buffers event data and posts it to the configured API endpoint, including the current email value in some incomplete-form events.

AI rationale

Evidence

dist/lystech-core-provider.umd.jspackage.jsonbin/postinstall.cjs

Network endpoints1

api.lystech.ca/api/client-events

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser provider buffers session identifiers, an email address, and user events for transmission.
The checkout flow records entered email addresses when a form is incomplete or the two email entries differ.
Buffered events are sent automatically to the configured API endpoint.
The install hook creates a repository workflow that later contacts the package registry service.

Evidence against

The provider sends events to its configured Lystech API, consistent with the package’s stated app-provider role.
The registry workflow only registers a repository when it detects this package in project dependencies.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/check-pwa.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

3// Script universel de vérification PWA pour un projet Node.js (CommonJS) L4: const fs = require("fs"); L5: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/check-pwa.cjsView on unpkg · L3

dist/lystech-core-provider.umd.jsView file

16* LICENSE file in the root directory of this source tree. L17: */var S0;function j4(){return S0||(S0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ne+Q}}var ae=!1,se;{var $=typeof WeakMap=="function"?WeakMap:Map;se=new $}function oe(Q,Ie){if(!Q||ae)return"";{var Fe=se.get(Q);if(Fe!==void 0)return Fe}var He;ae=!0;var rt=Erro... ... L20: `),xt=ut.length-1,pe=Bt.length-1;xt>=1&&pe>=0&&ut[xt]!==Bt[pe];)pe--;for(;xt>=1&&pe>=0;xt--,pe--)if(ut[xt]!==Bt[pe]){if(xt!==1||pe!==1)do if(xt--,pe--,pe<0||ut[xt]!==Bt[pe]){var Ae... L21: `+ut[xt].replace(" at new "," at ");return Q.displayName&&Ae.includes("<anonymous>")&&(Ae=Ae.replace("<anonymous>",Q.displayName)),typeof Q=="function"&&se.set(Q

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.umd.jsView on unpkg · L16

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var S0;function j4(){return S0||(S0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ne+Q}}var ae=!1,se;{var $=typeof WeakMap=="function"?WeakMap:Map;se=new $}function oe(Q,Ie){if(!Q||ae)return"";{var Fe=se.get(Q);if(Fe!==void 0)return Fe}var He;ae=!0;var rt=Erro... ... L20: `),xt=ut.length-1,pe=Bt.length-1;xt>=1&&pe>=0&&ut[xt]!==Bt[pe];)pe--;for(;xt>=1&&pe>=0;xt--,pe--)if(ut[xt]!==Bt[pe]){if(xt!==1||pe!==1)do if(xt--,pe--,pe<0||ut[xt]!==Bt[pe]){var Ae... L21: `+ut[xt].replace(" at new "," at ");return Q.displayName&&Ae.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 248aa4a49eb96e68 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @lystech/core@3.0.126 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/attach.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.126 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.126 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/check-pwa.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/check-pwa.cjsView on unpkg

Findings

2 Critical7 High5 Medium6 Low

CriticalCredential Exfiltrationdist/lystech-core-provider.umd.js

CriticalTrigger Reachable Dangerous Capabilitydist/lystech-core-provider.umd.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationdist/lystech-core-provider.umd.js

HighKnown Malware Source Similaritybin/attach.cjs

HighKnown Malware Source Similaritybin/check-pwa.cjs

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/setup-registry.cjs

HighKnown Malware Source Fingerprint Signaturebin/attach.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

Medium

Affected versions and remediation

This report applies to @lystech/core@3.0.137.

See all versions of @lystech/core for other recorded verdicts.

Review the evidence and your use of @lystech/core@3.0.137 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 00:57:07.919Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.