registry / @servicetitan/startup / 39.0.0

@servicetitan/startup@39.0.0

CLI to create multi-package Lerna projects with TypeScript and React

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection shows package-aligned lifecycle maintenance and explicit CLI functionality, not a concrete malicious chain. Token-gated telemetry is vendor-directed and does not establish malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, prepare, or an explicit startup CLI command

Impact

No unauthorized persistence, payload execution, credential theft, or AI-agent control-surface modification established.

Mechanism

local patch application, bin-wrapper generation, and token-gated vendor telemetry

AI rationale

Evidence

package.jsonsrc/postinstall.jssrc/scripts/generate-bin-wrappers.jsbin/_run.jssrc/telemetry/telemetry.tssrc/cli/commands/upload-sourcemaps.tspatches/jsdom+26.1.0.dev.patchnode_modules/.pnpmbin

Network endpoints1

browser-intake-datadoghq.com/api/v2/logs

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

postinstall only applies the bundled jsdom patch through patch-package and removes temporary pnpm symlinks.
prepare generates local bin wrappers from declared dependencies.
Child-process use is in user-invoked CLI commands or dependency-bin wrappers.
Telemetry posts to Datadog only when a Datadog client token is available; no credential harvesting or foreign-agent mutation found.
The shipped patch only changes jsdom Window property configurability.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 741 file(s), 1.04 MB of source, external domains: docs.st.dev, github.com, nodejs.org, unpkg.servicetitan.com, unpkg.st.dev, verdaccio.servicetitan.com, verdaccio.st.dev

Source & flagged code

11 flagged

package.jsonView file

Lines 65-105json

65 "stylelint": "./bin/stylelint.js",

66 "swc": "./bin/swc.js",

67 "swcx": "./bin/swcx.js",

68 "tcm": "./bin/tcm.js",

69 "ts-jest": "./bin/ts-jest.js",

70 "ts-node": "./bin/ts-node.js",

71 "ts-node-cwd": "./bin/ts-node-cwd.js",

72 "ts-node-esm": "./bin/ts-node-esm.js",

73 "ts-node-script": "./bin/ts-node-script.js",

74 "ts-node-transpile-only": "./bin/ts-node-transpile-only.js",

75 "ts-script": "./bin/ts-script.js",

76 "tsc": "./bin/tsc.js",

77 "tsserver": "./bin/tsserver.js",

78 "vite": "./bin/vite.js",

79 "vitest": "./bin/vitest.js",

80 "webpack": "./bin/webpack.js",

81 "webpack-bundle-analyzer": "./bin/webpack-bundle-analyzer.js",

82 "webpack-dev-server": "./bin/webpack-dev-server.js"

83 },

84 "scripts": {

85 "postinstall": "node ./src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 "prepare": "node ./src/scripts/generate-bin-wrappers.js"

87 },

88 "devDependencies": {

89 "@swc/types": "^0.1.27",

90 "@types/cpx": "~1.5.5",

91 "@types/debug": "^4.1.12",

92 "@types/eslint": "~9.6.1",

93 "@types/js-yaml": "^4.0.9",

94 "@types/less": "~3.0.8",

95 "@types/lodash.kebabcase": "^4.1.9",

96 "@types/lodash.memoize": "^4.1.9",

97 "@types/moment-locales-webpack-plugin": "~1.2.2",

98 "@types/webpack-assets-manifest": "~5.1.4",

99 "@types/yargs": "~17.0.35"

100 },

101 "dependencies": {

102 "@babel/preset-env": "~7.29.7",

103 "@jest/core": "~30.4.2",

104 "@jest/types": "~30.4.1",

105 "@jsdevtools/coverage-istanbul-loader": "^3.0.5",

bin/_run.jsView file

Lines 1-33javascript

1/**

2 * Shared helper for bin wrappers generated by scripts/generate-bin-wrappers.js.

3 *

4 * Locates a dependency's bin script by walking up the node_modules tree from

5 * the caller's directory, then executes it with the same argv. Works with both

6 * npm (flat hoisting) and pnpm (strict isolation).

7 *

8 * Caveat (npm only): if npm nests a different version of a package inside

9 * startup's node_modules and startup's bin wrapper is installed last, the

10 * consumer may get startup's version instead of their own. Keeping versions

dist/cli/tasks/cli-task.jsView file

Lines 1-30javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", {

3 value: true

4});

5Object.defineProperty(exports, "CliTask", {

6 enumerable: true

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView file

Lines 1-28javascript

1"use strict";

2/* eslint-disable */ // @ts-nocheck

3module.exports = function() {

4 if (typeof globalThis === 'object') {

bin/webpack.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2// Auto-generated by scripts/generate-bin-wrappers.js - wraps: webpack -> bin/webpack.js

3require('./_run')('webpack', 'bin/webpack.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/webpack.jsView on unpkg · L2

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView file

Lines 31-71typescript

32 return {

33 name: 'st:shared-dependencies',

34 enforce: 'pre',

36 config(_, env) {

37 isProduction

dist/cli/commands/clean.jsView file

Lines 43-83javascript

43var CleanProcesses = /*#__PURE__*/ function(CleanProcesses) {

44 CleanProcesses[CleanProcesses["CleanGitWorkingTree"] = 0] = "CleanGitWorkingTree";

45 CleanProcesses[CleanProcesses["ClearJestCache"] =

dist/cli/commands/upload-sourcemaps.jsView file

•matchType = normalized_sha256 matchedPackage = @servicetitan/startup@38.1.4 matchedPath = dist/cli/commands/upload-sourcemaps.js matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:38.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/upload-sourcemaps.jsView on unpkg

dist/webpack/configs/dev-server-config.jsView file

•matchType = normalized_sha256 matchedPackage = @servicetitan/startup@38.1.4 matchedPath = dist/webpack/configs/dev-server-config.js matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:38.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/webpack/configs/dev-server-config.jsView on unpkg

dist/webpack/loaders/expose-loader/utils/stringify-request.jsView file

•matchType = normalized_sha256 matchedPackage = @servicetitan/startup@38.1.4 matchedPath = dist/webpack/loaders/expose-loader/utils/stringify-request.js matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:38.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/webpack/loaders/expose-loader/utils/stringify-request.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/_run.jsView file

13*/ L14: const { execFileSync } = require('child_process'); L15: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/_run.jsView on unpkg · L13

Findings

7 High5 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/_run.js

HighShelldist/cli/tasks/cli-task.js

HighRuntime Package Installdist/cli/commands/clean.js

HighKnown Malware Source Similaritydist/cli/commands/upload-sourcemaps.js

HighKnown Malware Source Similaritydist/webpack/configs/dev-server-config.js

HighKnown Malware Source Similaritydist/webpack/loaders/expose-loader/utils/stringify-request.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @servicetitan/startup@39.0.0.

See all versions of @servicetitan/startup for other recorded verdicts.

Review the evidence and your use of @servicetitan/startup@39.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-21 07:03:39.720Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @servicetitan

Behavioral surface

Related packages

More from @servicetitan

Source & flagged code