registry / @servicetitan/startup / 40.2.0
@servicetitan/startup@40.2.0
CLI to create multi-package Lerna projects with TypeScript and React
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection resolves the lifecycle hook to a project-scoped patch operation and the flagged runtime locations to gated Vite build behavior. The package also emits token-gated command telemetry to its declared Datadog service; the inspected source does not establish a concrete attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the declared postinstall; Vite plugins run when the related build configuration is used; CLI telemetry runs with command events when a client token is available.
Impact
No credential theft, unrequested account changes, destructive install-time action, or malicious external transfer was established.
Mechanism
The setup hook applies the included jsdom patch, Vite writes local metadata and logs requests, and CLI commands send usage events to Datadog.
AI rationale
Source inspection resolves the lifecycle hook to a project-scoped patch operation and the flagged runtime locations to gated Vite build behavior. The package also emits token-gated command telemetry to its declared Datadog service; the inspected source does not establish a concrete attack.
Evidence
package.jsonsrc/postinstall.jspatches/jsdom+26.1.0.dev.patchdist/vite/plugins/dev-server-routing-plugin.jsdist/vite/plugins/istanbul-plugin.jsdist/vite/plugins/metadata-plugin.jsdist/telemetry/telemetry.jssrc/cli/commands/clean.ts
Network endpoints1
browser-intake-datadoghq.com/api/v2/logs
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s postinstall runs a patch helper, while prepare generates command wrappers.
- The postinstall helper applies patches only in a project installation; the sole patch changes jsdom property configurability.
- Vite coverage instrumentation is gated by codeCoverage; metadata generation is gated by web-component status and writes local entrypoint files.
- The Vite base config registers these plugins; the dev-server plugin logs requests, and webpack proxy loading requires a configured existing file.
- CLI wrappers run resolved dependency scripts with caller arguments; the clean command performs cache cleanup and git clean when invoked.
- CLI telemetry sends command events to Datadog only when a client token is available, with service, repository, and runtime context.
Evidence against
- CLI telemetry can include repository and branch data, hostname, and git user details; source shows a fixed Datadog destination and a client-token gate.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./src/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./src/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/_run.jsView file
13*/
L14: const { execFileSync } = require('child_process');
L15: const fs = require('fs');
High
Findings
5 High5 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/_run.js
HighShellsrc/cli/commands/clean.ts
HighRuntime Package Installdist/cli/commands/clean.js
HighKnown Malware Source Similaritydist/webpack/configs/dev-server-config.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/webpack.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/webpack/loaders/expose-loader/runtime/get-global-this.js
Low
Affected versions and remediation
This report applies to @servicetitan/startup@40.2.0.
See all versions of @servicetitan/startup for other recorded verdicts.
- Review the evidence and your use of @servicetitan/startup@40.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.