@noctrodex/sast@1.0.0-rc.6
NOCTRODEX(GHOSTMASTER) SAST — War Room GUI. The scan engine runs on your own host and scans from your own IP.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real install-hook supply-chain risk because it automatically invokes pip, so it should be warned on. Static source inspection found no concrete malicious behavior sufficient to block publication.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs the postinstall lifecycle hook.
Impact
Additional Python packages may be downloaded and executed during installation in the user's environment.
Mechanism
Automatic pip installation through a selected Python executable.
AI rationale
The package has a real install-hook supply-chain risk because it automatically invokes pip, so it should be warned on. Static source inspection found no concrete malicious behavior sufficient to block publication.
Evidence
package.jsonbin/postinstall.js
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- An npm postinstall hook automatically invokes pip to install Python packages into the user's account.
- The install hook runs a Python executable selected from an environment variable or PATH, increasing install-time execution exposure.
Evidence against
- The hook is transparent and installs named GUI dependencies only; no credential collection or exfiltration appears in it.
- The launcher’s HTTP health check is restricted to loopback.
- The external control-plane request is tied to an interactive sign-in or terms-acceptance flow.
- No self-dependency, obfuscated payload, agent-control-surface write, or destructive action was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/postinstall.jsView file
3// the readable GUI half needs these, and they are installed for the user, never system-wide.
L4: const { spawnSync } = require("child_process");
L5: const py = process.env.NOCTRODEX_PYTHON || (process.platform === "win32" ? "python" : "python3");
High
Child Process
Package source references child process execution.
bin/postinstall.jsFindings
4 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/postinstall.js
HighSame File Env Network Executionbin/noctrodex-sast.js
HighSandbox Evasion Gated Capabilitybin/noctrodex-sast.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpython/noctrodex_sast/branding.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @noctrodex/sast@1.0.0-rc.6.
See all versions of @noctrodex/sast for other recorded verdicts.
- Review the evidence and your use of @noctrodex/sast@1.0.0-rc.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.