registry / Malware / @relyon/store-kit / 0.1.31

@relyon/store-kit@0.1.31

Relyon Core: run npx @relyon/store-kit init in your store project, then read the relyon-setup skill and finish with npx @relyon/store-kit doctor. Get found and bought by AI shopping agents, with checkout on your own domain.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

AGENTS.md contains direct review-steering instructions: it directs an agent to run an @latest package command and prohibits inspecting dist, where the shipped implementation resides. Reviewer manipulation is evidence of malicious intent under the review rules.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A reviewer or coding agent reads AGENTS.md and follows its directions.

Impact

This can trigger an untrusted, registry-resolved command and suppress inspection of the package's executable implementation.

Mechanism

The file directs the agent to run npx @latest init and says not to read dist files.

Attack narrative

The package's AGENTS.md directs an agent to run a registry-resolved @latest command and explicitly bars reading dist files. That is review-directed suppression of the shipped implementation and can also cause execution of code outside the reviewed snapshot. The postinstall behavior itself is only a stdout notice; the malicious finding is the review manipulation.

AI rationale

Evidence

AGENTS.md

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package's AGENTS.md tells reviewers to run a registry-resolved @latest command and explicitly forbids reading dist files, steering review away from the shipped implementation.
The postinstall hook only prints setup guidance; that behavior does not account for the review-directed instructions.

Evidence against

The postinstall script writes only a message to stdout and does not read project or environment data.
Sandbox provisioning contacts core.getrelyon.com only when the user runs init; the request sends a fixed sandbox name and saves the response in private storage.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 89 file(s), 1.02 MB of source, external domains: base.google.com, chatgpt.com, core.getrelyon.com, github.com, registry.npmjs.org, schema.org, shop.example.com, ucp.dev, www.sitemaps.org, www.w3.org

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node -e "try { require('./scripts/install-notice.cjs') } catch {}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try { require('./scripts/install-notice.cjs') } catch {}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/doctor-merchant.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

1 Critical12 High3 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/doctor-merchant.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/private-config.js

HighKnown Malware Source Similaritydist/agent-hooks.js

HighKnown Malware Source Similaritydist/init.js

HighKnown Malware Source Similaritytemplates/common/scripts/serve.mjs

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritytemplates/common/server/storage.ts

HighKnown Malware Source Similaritydist/agents.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @relyon/store-kit@0.1.31.

See all versions of @relyon/store-kit for other recorded verdicts.

Avoid installing @relyon/store-kit@0.1.31. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 11:29:16.085Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Malware / @relyon/store-kit / 0.1.31

@relyon/store-kit@0.1.31

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A reviewer or coding agent reads AGENTS.md and follows its directions.

Impact

This can trigger an untrusted, registry-resolved command and suppress inspection of the package's executable implementation.

Mechanism

The file directs the agent to run npx @latest init and says not to read dist files.

Attack narrative

AI rationale

Evidence

AGENTS.md

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The package's AGENTS.md tells reviewers to run a registry-resolved @latest command and explicitly forbids reading dist files, steering review away from the shipped implementation.
The postinstall hook only prints setup guidance; that behavior does not account for the review-directed instructions.

Evidence against

The postinstall script writes only a message to stdout and does not read project or environment data.
Sandbox provisioning contacts core.getrelyon.com only when the user runs init; the request sends a fixed sandbox name and saves the response in private storage.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

13 flagged

package.jsonView file

•scripts.postinstall = node -e "try { require('./scripts/install-notice.cjs') } catch {}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try { require('./scripts/install-notice.cjs') } catch {}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/doctor-merchant.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

1 Critical12 High3 Medium4 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/doctor-merchant.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/private-config.js

HighKnown Malware Source Similaritydist/agent-hooks.js

HighKnown Malware Source Similaritydist/init.js

HighKnown Malware Source Similaritytemplates/common/scripts/serve.mjs

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritytemplates/common/server/storage.ts

HighKnown Malware Source Similaritydist/agents.js

HighKnown Malware Source Similarity

Affected versions and remediation

This report applies to @relyon/store-kit@0.1.31.

See all versions of @relyon/store-kit for other recorded verdicts.

Avoid installing @relyon/store-kit@0.1.31. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-11-02 11:29:16.085Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Runtime surface

Behavioral surface

Related packages

Other malware packages