registry / @servicetitan/startup / 40.1.0
@servicetitan/startup@40.1.0
CLI to create multi-package Lerna projects with TypeScript and React
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe inspected lifecycle, wrapper, cleanup, and development-server code is consistent with package setup and user-invoked tooling. The scanner signals do not establish concrete attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation in a project directory, invocation of a dependency bin wrapper, or explicit invocation of the clean command.
Impact
No malicious effect was established from these inspected behaviors.
Mechanism
The postinstall script runs patch-package; the clean command clears caches and runs git clean, while the bin wrapper forwards arguments to a resolved dependency script.
AI rationale
The inspected lifecycle, wrapper, cleanup, and development-server code is consistent with package setup and user-invoked tooling. The scanner signals do not establish concrete attack behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs a package script that applies package patches; it only proceeds when installed in a project directory.
- The bin helper runs the resolved dependency script with the caller's arguments.
- The clean command runs cache cleanup and `git clean -fdX` when invoked.
- The development server configuration returns early for production builds, exposed dependency builds, or when disabled.
Evidence against
- The inspected flagged shell and process execution are tied to the clean command or dependency bin forwarding; the flagged development server configuration is gated. No concrete attack behavior was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./src/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./src/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/_run.jsView file
13*/
L14: const { execFileSync } = require('child_process');
L15: const fs = require('fs');
High
Findings
5 High5 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/_run.js
HighShellsrc/cli/commands/clean.ts
HighRuntime Package Installdist/cli/commands/clean.js
HighKnown Malware Source Similaritydist/webpack/configs/dev-server-config.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/webpack.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/webpack/loaders/expose-loader/runtime/get-global-this.js
Low
Affected versions and remediation
This report applies to @servicetitan/startup@40.1.0.
See all versions of @servicetitan/startup for other recorded verdicts.
- Review the evidence and your use of @servicetitan/startup@40.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.