Loading npm security reports…

@realtek/core-theme@0.0.346: Malicious npm security report | LPM Firewall

registry / @realtek/core-theme / 0.0.346

@realtek/core-theme@0.0.346

RealTek CORE-THEME — shared React component & admin-screen library (AddFormV1, EditFormV1, ListView, DetailViewV1, ...).

AI Security Review

scanned 3h ago · by lpm-firewall-ai

An npm postinstall script can load consumer environment settings and seed a remote MongoDB database, including an administrator account and permissions. It also writes an initialization marker into the consumer project.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with CORE_THEME_AUTO_DB_INIT=1 and a database name available through the environment or project .env.

Impact

Unauthorized database schema and authorization changes, including creation or modification of an administrator account, can affect a reachable database.

Mechanism

Install-time MongoDB connection and privileged database seeding.

Attack narrative

The package registers a postinstall hook that loads the consumer project's .env. If its automatic-init condition is present, it uses a built-in credentialed MongoDB endpoint unless overridden, connects to the selected database, changes collections and indexes, seeds roles and permissions, and upserts an administrator account. The package also depends on an older range of itself, allowing a nested lifecycle-enabled release chain. This behavior is far beyond a shared UI theme's expected installation footprint.

Rationale

This package contains an install-time path that can mutate a remote database's authorization state and consumer project files. The opt-in environment gate reduces accidental activation but does not make the embedded privileged installer or self-dependency safe.

Evidence

package.jsonscripts/init-admin-mongodb.js.env.core-theme-mongodb-init.json

Network endpoints1

192.168.1.88

Source & flagged code

5 flagged

package.jsonView file

Lines 25-65json

25 "dist-lib",

26 "scripts/init-admin-mongodb.js"

27 ],

28 "sideEffects": [

29 "**/*.css"

30 ],

31 "publishConfig": {

32 "access": "public",

33 "registry": "https://registry.npmjs.org/"

34 },

35 "scripts": {

36 "install:hooks": "node scripts/install-git-hooks.js",

37 "setup": "npm ci && npm run install:hooks",

38 "predev": "node scripts/install-git-hooks.js",

39 "dev": "vite",

40 "pretest": "node scripts/install-git-hooks.js",

41 "build": "vite build",

42 "prebuild": "node scripts/install-git-hooks.js",

43 "build:lib": "vite build --config vite.lib.config.js",

44 "prepare": "npm run build:lib",

45 "postinstall": "node scripts/init-admin-mongodb.js --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "init:mongodb": "node scripts/init-admin-mongodb.js",

47 "check:publish": "node -e \"const p=require('./package.json');const s=p.scripts||{};const bad=['preinstall','install'].filter(k=>s[k]);if(bad.length){console.error('Refusing to publish '+p.name+': remove package lifecycle script(s): '+bad.join(', '));process.exit(1)}const expectedPostinstall='node scripts/init-admin-mongodb.js --postinstall';if(s.postinstall!==expectedPostinstall){console.error('Refusing to publish '+p.name+': postinstall must be '+JSON.stringify(expectedPostinstall)+'.');process.exit(1)}const expected=['dist-lib','scripts/init-admin-mongodb.js'];if(!Array.isArray(p.files) ...

48 "prepublishOnly": "npm run check:publish && npm run build:lib",

49 "lint": "eslint .",

50 "preview": "vite preview",

51 "test": "vitest run",

52 "test:dashboard": "node scripts/run-test-dashboard.js src/testcomponent",

53 "test:dashboard:addform": "node scripts/run-test-dashboard.js src/testcomponent/AddFormTestComponent",

54 "test:dashboard:listview": "node scripts/run-test-dashboard.js src/testcomponent/ListViewTestComponent",

55 "test:dashboard:detailview": "node scripts/run-test-dashboard.js src/testcomponent/DetailViewTestComponent",

56 "test:dashboard:editform": "node scripts/run-test-dashboard.js src/testcomponent/EditFormTestComponent",

57 "test:changed-components": "node scripts/run-changed-component-tests.js",

58 "pr:test": "node scripts/run-pr-component-tests.js",

59 "pr:create": "node scripts/create-pr-with-component-tests.js",

60 "test:addform": "vitest run src/testcomponent/AddFormTestComponent",

61 "test:addform:unit": "vitest run src/testcomponent/AddFormTestComponent/unit",

62 "test:addform:integration": "vitest run src/testcomponent/AddFormTestComponent/integration",

63 "test:addform:list": "vitest list src/testcomponent/AddFormTestComponent",

64 "test:editform": "vitest run src/testcomponent/EditFormTestComponent",

65 "test:editform:unit": "vitest run src/testcomponent/EditFormTestComponent/unit",

Long lines were clipped for display.

dist-lib/index.jsView file

10135patternName = generic_password severity = medium line = 10135

Medium

Secret Pattern

Package contains a possible secret pattern.

dist-lib/index.jsView on unpkg · L10135

scripts/init-admin-mongodb.jsView file

•scripts.postinstall = node scripts/init-admin-mongodb.js --postinstall Install-time source loads the consumer project environment, connects to an embedded authenticated MongoDB endpoint, creates or alters authorization collections, seeds a default administrator and permissions, and writes an initialization marker. const DEFAULT_MONGO_URI = 'mongodb://admin:e7cH06Dy2LK2@192.168.1.88:27017/znnxt?authSource=admin&authMechanism=SCRAM-SHA-256'; function loadProjectEnv() { function writeInitMarker({ mongoUri, dbName }) { await db.createCollection(name, { validator: collectionValidator }); async function createCollections(db) { async function seedAdminUser(db) { async function seedRoleMenuPermissions(db) { await createCollections(db);

Critical

Install Time Database Administration

An install lifecycle loads the consumer environment, connects to an embedded authenticated database endpoint, mutates authorization state, and seeds a default administrator.

scripts/init-admin-mongodb.jsView on unpkg

dist-lib/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist-lib/style.cssView on unpkg