@lystech/core@3.0.98

Lystech Core contains essentials for lystech apps

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The scanner's credential exfiltration hint is not supported by the inspected destination: the bundle configures the API client for the package's fixed service endpoint. Other flagged files expose setup utilities, but the reviewed source excerpts do not establish a concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The browser package entry point initializes the API client.

Impact

No confirmed attacker-controlled credential exposure or other attack impact was established.

Mechanism

The client is configured with api.lystech.ca as its base URL; inspected source did not establish credential forwarding to an unrestricted destination.

AI rationale

Evidence

package.jsondist/lystech-core-provider.umd.jsdist/lystech-core-provider.es.jsbin/attach.cjsbin/postinstall.cjsbin/setup-registry.cjsbin/check-pwa.cjs

Network endpoints1

api.lystech.ca/api/

Decision evidence

public snapshot

AI called this Clean at 79.0% confidence as Benign with medium false-positive risk.

Evidence for AI clean decision

The manifest exposes a postinstall hook and the flagged files are executable package entry points.
The browser bundle configures its API client to use the package's fixed api.lystech.ca service endpoint.
The package has setup utilities, but their behavior is not evidence of credential theft or another confirmed attack.

Evidence against

The inspected credential-bearing request code was not shown to send credentials to an unrestricted endpoint.
The package files inspected do not establish a concrete malicious attack surface.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 2.17 MB of source, external domains: accounts.google.com, ant.design, api.github.com, api.lystech.ca, apis.google.com, github.com, lysbunback-usgg4.ondigitalocean.app, lystech.firebaseio.com, momentjs.com, placehold.co, react-query.tanstack.com, reactjs.org, reactrouter.com, u.ant.design, www.google.com, www.paypal.com, www.sandbox.paypal.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

Lines 8-48json

8 "main": "dist/lystech-core-provider.umd.js",

9 "module": "dist/lystech-core-provider.es.js",

10 "types": "dist/index.d.ts",

11 "publishConfig": {

12 "access": "public"

13 },

14 "files": [

15 "dist",

16 "bin"

17 ],

18 "scripts": {

19 "test": "echo \"Error: no test specified\" && exit 1",

20 "build": "vite build",

21 "dev": "vite --config vite.config.dev.ts",

22 "demo": "vite --config vite.config.demo.ts",

23 "preview": "vite preview --config vite.config.dev.ts",

24 "deploy": "deploy.bat",

25 "check-pwa": "node ./bin/check-pwa.cjs",

26 "setup-github-action": "node ./bin/setup-github-action.cjs",

27 "setup-auto-update-workflow": "node ./bin/setup-github-action.cjs",

28 "postinstall": "node bin/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "trigger-workflow": "git add -A && (git diff-index --quiet HEAD || git commit -m \"Update changes\") && git pull --rebase && git commit --allow-empty -m \"Trigger GitHub workflow\" && git push",

30 "sync:local": "npm run build && node scripts/sync-local-core.mjs"

31 },

32 "dependencies": {

33 "@mantine/core": "^8.1.3",

34 "@mantine/dates": "^8.1.3",

35 "@paypal/react-paypal-js": "^8.8.3",

36 "@phosphor-icons/react": "^2.1.10",

37 "@react-oauth/google": "^0.12.1",

38 "@tanstack/react-query": "^4.35.0",

39 "antd": "^5.12.8",

40 "axios": "^1.0.0",

41 "dompurify": "^3.4.11",

42 "firebase": "^9.9.4",

43 "jwt-decode": "^4.0.0",

44 "ldrs": "^1.1.9",

45 "moment": "^2.30.1",

46 "react-countup": "^6.5.3",

47 "vite-plugin-dts": "^4.5.4"

48 },

dist/lystech-core-provider.umd.jsView file

16Trigger-reachable chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var P0;function L4(){return P0||(P0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ae+G}}var ie=!1,le;{var K=typeof WeakMap=="function"?WeakMap:Map;le=new K}function te(G,we){if(!G||ie)return"";{var Re=le.get(G);if(Re!==void 0)return Re}var Fe;ie=!0;var nt=Erro... ... L20: `),xt=ut.length-1,At=Ht.length-1;xt>=1&&At>=0&&ut[xt]!==Ht[At];)At--;for(;xt>=1&&At>=0;xt--,At--)if(ut[xt]!==Ht[At]){if(xt!==1||At!==1)do if(xt--,At--,At<0||ut[xt]!==Ht[At]){var We... L21: `+ut[xt].replace(" at new "," at ");return G.displayName&&We.includes("<anonymous>")&

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/lystech-core-provider.umd.jsView on unpkg · L16

1727patternName = google_api_key severity = high line = 1727

High

High Secret

Package contains a high-severity secret pattern.

dist/lystech-core-provider.umd.jsView on unpkg · L1727

16Trigger-reachable credential exfiltration chain: manifest.main -> dist/lystech-core-provider.umd.js L16: * LICENSE file in the root directory of this source tree. L17: */var P0;function L4(){return P0||(P0=1,process.env.NODE_ENV!=="production"&&function(){var e=O,t=Symbol.for("react.element"),n=Symbol.for("react.portal"),r=Symbol.for("react.fragm... L18: `+ae+G}}var ie=!1,le;{var K=typeof WeakMap=="function"?WeakMap:Map;le=new K}function te(G,we){if(!G||ie)return"";{var Re=le.get(G);if(Re!==void 0)return Re}var Fe;ie=!0;var nt=Erro... ... L20: `),xt=ut.length-1,At=Ht.length-1;xt>=1&&At>=0&&ut[xt]!==Ht[At];)At--;for(;xt>=1&&At>=0;xt--,At--)if(ut[xt]!==Ht[At]){if(xt!==1||At!==1)do if(xt--,At--,At<0||ut[xt]!==Ht[At]){var We... L21: `+ut[xt].replace(" at new "," at ");return G.displayName&&We.

dist/lystech-core-provider.es.jsView file

44function pO() { L45: return Dp || (Dp = 1, process.env.NODE_ENV !== "production" && function() { L46: var e = he, t = Symbol.for("react.element"), n = Symbol.for("react.portal"), r = Symbol.for("react.fragment"), a = Symbol.for("react.strict_mode"), i = Symbol.for("react.profiler")... ... L401: var De = function() { L402: ke || (ke = !0, y("%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you shou... L403: }; ... L670: for (let r = 0; r < e.length; r++) { L671: let a = e.charCodeAt(r); L672: a < 128 ? t[n++] = a : a < 2048 ? (t[n++] = a >> 6 | 192, t[n++] = a & 63 | 128) : (a & 64512) === 55296 && r + 1 < e.length && (e.charCodeAt(r + 1) & 64512) === 56320 ? (a = 65536... ... L704:

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lystech-core-provider.es.jsView on unpkg · L44

bin/attach.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.122 matchedPath = bin/attach.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/attach.cjsView on unpkg

bin/postinstall.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.122 matchedPath = bin/postinstall.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.cjsView on unpkg

bin/setup-registry.cjsView file

•matchType = normalized_sha256 matchedPackage = @lystech/core@3.0.122 matchedPath = bin/setup-registry.cjs matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/setup-registry.cjsView on unpkg

bin/check-pwa.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lystech/core@3.0.114 matchedIdentity = npm:QGx5c3RlY2gvY29yZQ:3.0.114 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/check-pwa.cjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lystech-core-provider.umd.jsView file

Findings

3 Critical7 High4 Medium5 Low

CriticalCredential Exfiltrationdist/lystech-core-provider.es.js

CriticalTrigger Reachable Dangerous Capabilitydist/lystech-core-provider.umd.js

CriticalPrevious Version Dangerous Deltabin/check-pwa.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretdist/lystech-core-provider.umd.js

HighTrigger Reachable Credential Exfiltrationdist/lystech-core-provider.umd.js

HighKnown Malware Source Similaritybin/attach.cjs

HighKnown Malware Source Similaritybin/postinstall.cjs

HighKnown Malware Source Similaritybin/setup-registry.cjs

HighSecret Patterndist/lystech-core-provider.umd.js

Medium

Affected versions and remediation

This report applies to @lystech/core@3.0.98.

See all versions of @lystech/core for other recorded verdicts.

Review the evidence and your use of @lystech/core@3.0.98 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 23:44:54.244Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.