registry / @servicetitan/startup / 40.0.0

@servicetitan/startup@40.0.0

CLI to create multi-package Lerna projects with TypeScript and React

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Inspected source shows package-scoped patch handling at install time and user-invoked CLI cleanup or dependency-bin execution. No concrete malicious behavior was established in the reviewed paths.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Package installation triggers postinstall; clean and bin execution require user invocation.

Impact

No credential exposure, unrelated network communication, or agent control-surface mutation was established.

Mechanism

Postinstall invokes patch-package for the consumer project's patch directory and removes temporary pnpm symlinks. The clean command resets named caches and runs git clean; webpack proxy loading uses configured paths.

AI rationale

Inspected source shows package-scoped patch handling at install time and user-invoked CLI cleanup or dependency-bin execution. No concrete malicious behavior was established in the reviewed paths.

Evidence

package.jsonsrc/postinstall.jssrc/cli/commands/clean.tsdist/cli/commands/clean.jsbin/_run.jsdist/webpack/configs/dev-server-config.js

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook is limited to patch-package patches in the consumer project and cleans up temporary pnpm symlinks.
The clean command runs when invoked and performs named cache reset and cleanup operations.
Bin wrappers execute the selected dependency bin with the caller's arguments.
Webpack proxy loading uses a path from bundler configuration and checks that the path exists.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 753 file(s), 1.06 MB of source, external domains: docs.st.dev, github.com, nodejs.org, unpkg.servicetitan.com, unpkg.st.dev, verdaccio.servicetitan.com, verdaccio.st.dev

Source & flagged code

9 flagged

package.jsonView file

Lines 65-105json

65 "stylelint": "./bin/stylelint.js",

66 "swc": "./bin/swc.js",

67 "swcx": "./bin/swcx.js",

68 "tcm": "./bin/tcm.js",

69 "ts-jest": "./bin/ts-jest.js",

70 "ts-node": "./bin/ts-node.js",

71 "ts-node-cwd": "./bin/ts-node-cwd.js",

72 "ts-node-esm": "./bin/ts-node-esm.js",

73 "ts-node-script": "./bin/ts-node-script.js",

74 "ts-node-transpile-only": "./bin/ts-node-transpile-only.js",

75 "ts-script": "./bin/ts-script.js",

76 "tsc": "./bin/tsc.js",

77 "tsserver": "./bin/tsserver.js",

78 "vite": "./bin/vite.js",

79 "vitest": "./bin/vitest.js",

80 "webpack": "./bin/webpack.js",

81 "webpack-bundle-analyzer": "./bin/webpack-bundle-analyzer.js",

82 "webpack-dev-server": "./bin/webpack-dev-server.js"

83 },

84 "scripts": {

85 "postinstall": "node ./src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 "prepare": "node ./src/scripts/generate-bin-wrappers.js"

87 },

88 "devDependencies": {

89 "@swc/types": "^0.1.28",

90 "@types/cpx": "~1.5.5",

91 "@types/debug": "^4.1.12",

92 "@types/eslint": "~9.6.1",

93 "@types/js-yaml": "^4.0.9",

94 "@types/less": "~3.0.8",

95 "@types/lodash.kebabcase": "^4.1.9",

96 "@types/lodash.memoize": "^4.1.9",

97 "@types/moment-locales-webpack-plugin": "~1.2.2",

98 "@types/webpack-assets-manifest": "~5.1.4",

99 "@types/yargs": "~17.0.35"

100 },

101 "dependencies": {

102 "@babel/preset-env": "~7.29.7",

103 "@jest/core": "~30.5.1",

104 "@jest/types": "~30.5.1",

105 "@jsdevtools/coverage-istanbul-loader": "^3.0.5",

bin/_run.jsView file

Lines 1-33javascript

1/**

2 * Shared helper for bin wrappers generated by scripts/generate-bin-wrappers.js.

3 *

4 * Locates a dependency's bin script by walking up the node_modules tree from

5 * the caller's directory, then executes it with the same argv. Works with both

6 * npm (flat hoisting) and pnpm (strict isolation).

7 *

8 * Caveat (npm only): if npm nests a different version of a package inside

9 * startup's node_modules and startup's bin wrapper is installed last, the

10 * consumer may get startup's version instead of their own. Keeping versions

src/cli/commands/clean.tsView file

Lines 1-21typescript

1import { getPackageManager } from '@servicetitan/install';

2import { exec as execAsync, execSync } from 'node:child_process';

3import fs from 'node:fs';

High

Shell

Package source references shell execution.

src/cli/commands/clean.tsView on unpkg · L1

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView file

Lines 1-28javascript

1"use strict";

2/* eslint-disable */ // @ts-nocheck

3module.exports = function() {

4 if (typeof globalThis === 'object') {

bin/webpack.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2// Auto-generated by scripts/generate-bin-wrappers.js - wraps: webpack -> bin/webpack.js

3require('./_run')('webpack', 'bin/webpack.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/webpack.jsView on unpkg · L2

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView file

Lines 31-71typescript

32 return {

33 name: 'st:shared-dependencies',

34 enforce: 'pre',

36 config(_, env) {

37 isProduction

dist/cli/commands/clean.jsView file

Lines 43-83javascript

43var CleanProcesses = /*#__PURE__*/ function(CleanProcesses) {

44 CleanProcesses[CleanProcesses["CleanGitWorkingTree"] = 0] = "CleanGitWorkingTree";

45 CleanProcesses[CleanProcesses["ClearJestCache"] =

dist/webpack/configs/dev-server-config.jsView file

•matchType = normalized_sha256 matchedPackage = @servicetitan/startup@38.1.4 matchedPath = dist/webpack/configs/dev-server-config.js matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:38.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/webpack/configs/dev-server-config.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/_run.jsView file

13*/ L14: const { execFileSync } = require('child_process'); L15: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/_run.jsView on unpkg · L13

Findings

5 High5 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/_run.js

HighShellsrc/cli/commands/clean.ts

HighRuntime Package Installdist/cli/commands/clean.js

HighKnown Malware Source Similaritydist/webpack/configs/dev-server-config.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/webpack/loaders/expose-loader/runtime/get-global-this.js

Low

Affected versions and remediation

This report applies to @servicetitan/startup@40.0.0.

See all versions of @servicetitan/startup for other recorded verdicts.

Review the evidence and your use of @servicetitan/startup@40.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 03:06:40.270Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @servicetitan

Behavioral surface

Related packages

More from @servicetitan

Source & flagged code