registry / Destructive action / @rowansenne/docnexus / 0.24.3

@rowansenne/docnexus@0.24.3

[English README](./README.md)

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The install hook performs an automatic destructive cleanup of legacy project directories without migrating their contents or requiring confirmation. The legacy checks limit its scope, but do not prevent data loss for users upgrading through installation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package locally with npm, which runs its postinstall hook.

Impact

Existing project data in those legacy directories can be irreversibly lost during installation.

Mechanism

The hook resolves the consuming project and invokes cleanup that recursively removes directories passing legacy checks.

Attack narrative

A local npm installation triggers postinstall cleanup. The cleanup identifies legacy DocNexus directories and removes their contents recursively without migration. This can cause irreversible loss of project data during installation, despite the checks limiting deletion to recognized legacy directories.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/src/legacy-cleanup.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest runs a postinstall script during package installation.
The hook resolves the consuming project and calls legacy cleanup for local installs.
Cleanup checks for legacy project directories, then recursively deletes them without migrating their contents.
The cleanup routine describes the transition as destructive and removes the legacy workspace directory.

Evidence against

Cleanup is limited to directories that pass legacy-format checks; it does not target arbitrary project directories.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 370 KB of source, external domains: 127.0.0.1

Source & flagged code

5 flagged

package.jsonView file

Lines 23-63json

23 "viewer",

24 "skills",

25 "scripts/postinstall.mjs",

26 "README.md",

27 "README.zh-CN.md",

28 "CHANGELOG.md",

29 "LICENSE",

30 "SECURITY.md",

31 "docs",

32 "!docs/operations/baselines"

33 ],

34 "publishConfig": {

35 "access": "public"

36 },

37 "bin": {

38 "docnexus": "dist/src/cli.js"

39 },

40 "scripts": {

41 "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node -e \"require('node:fs').chmodSync('dist/src/cli.js', 0o755)\"",

42 "prepack": "npm run build",

43 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L43

44 "test": "vitest run",

45 "typecheck": "tsc -p tsconfig.json --noEmit",

46 "audit:prod": "npm audit --omit=dev --audit-level=high",

High

Suspicious Lifecycle Evidence

The manifest runs a postinstall script during package installation.

package.jsonView on unpkg · L43

47 "eval:retrieval": "npm run build && node scripts/eval-retrieval.mjs",

48 "eval:retrieval:quality": "npm run build && node scripts/eval-retrieval-quality.mjs",

49 "eval:knowledge": "npm run build && node scripts/eval-knowledge.mjs",

50 "eval:agent": "npm run build && node scripts/eval-agent.mjs"

51 },

52 "devDependencies": {

53 "@electric-sql/pglite-socket": "^0.2.13",

54 "@types/node": "^24.0.0",

55 "typescript": "^5.8.0",

56 "vitest": "^3.1.0"

57 },

58 "dependencies": {

59 "@electric-sql/pglite": "^0.5.10",

60 "@electric-sql/pglite-pgvector": "^0.0.11",

61 "@huggingface/transformers": "^4.3.1",

62 "markdown-it": "^15.0.3",

63 "postgres": "^3.4.9"

scripts/postinstall.mjsView file

Lines 1-15javascript

1import { basename, dirname } from "node:path";

2import { fileURLToPath } from "node:url";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

4const packageRoot =

dist/src/skills.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { existssync, readfilesync } from "node:fs"; import { cp, lstat, mkdir, readfile, readlink, rm, stat, symlink, writefile } from "node:fs/promises"; import { installagentcontext } from "./agent-context.js"; import { dirname, join, relative, resolve } from "node:path"; import { fileurltopath } from "node:url"; import { skillspath, internal_dirname } from "./layout.js"; import { ensureignoredentries } from "./workspace-io.js"; export const sk[redacted] = ["claude", "codex"]; export const skill_names = [ "docnexus", "docnexus-extract", "docnexus-ingest", "docnexus-reca

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/skills.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

43"postinstall": "node scripts/postinstall.mjs", "test": "vitest run", "typecheck": "tsc -p tsconfig.json --noEmit", "audit:prod": "npm audit --omit=dev --audit-level=hig

High

Suspicious Lifecycle Evidence

The manifest runs a postinstall script during package installation.

package.jsonView on unpkg · L43

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/src/skills.js

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @rowansenne/docnexus@0.24.3.

See all versions of @rowansenne/docnexus for other recorded verdicts.

Avoid installing @rowansenne/docnexus@0.24.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-21 17:28:23.742Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other destructive action packages

Behavioral surface

Related packages

Other destructive action packages

Source & flagged code