registry / @servicetitan/startup / 40.2.2

@servicetitan/startup@40.2.2

CLI to create multi-package Lerna projects with TypeScript and React

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Source inspection showed project-scoped patch application during installation and cleanup operations activated by the explicit clean command. The scanner’s dynamic execution and runtime install signals are consistent with CLI tooling and configuration handling; no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installation runs the postinstall hook; cache and ignored-file cleanup runs when a user invokes the startup clean command.

Impact

No confirmed attack surface was established; cleanup affects user-requested project caches and ignored files.

Mechanism

The hook creates temporary pnpm symlinks for patch-package and removes them afterward. The CLI clean command clears caches and runs git clean for ignored files.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook applies the project’s patch-package patches only when installed in a project directory; the prepare hook generates dependency bin wrappers.
The cache-clearing and ignored-file cleanup behavior is reached through the startup CLI’s explicit clean command.
The inspected runtime modules are build, CLI, and bundler utilities; the flagged dev-server code reads configuration from the supplied bundler settings.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 777 file(s), 1.10 MB of source, external domains: docs.st.dev, github.com, nodejs.org, unpkg.servicetitan.com, unpkg.st.dev, verdaccio.servicetitan.com, verdaccio.st.dev

Source & flagged code

10 flagged

package.jsonView file

Lines 65-105json

65 "stylelint": "./bin/stylelint.js",

66 "swc": "./bin/swc.js",

67 "swcx": "./bin/swcx.js",

68 "tcm": "./bin/tcm.js",

69 "ts-jest": "./bin/ts-jest.js",

70 "ts-node": "./bin/ts-node.js",

71 "ts-node-cwd": "./bin/ts-node-cwd.js",

72 "ts-node-esm": "./bin/ts-node-esm.js",

73 "ts-node-script": "./bin/ts-node-script.js",

74 "ts-node-transpile-only": "./bin/ts-node-transpile-only.js",

75 "ts-script": "./bin/ts-script.js",

76 "tsc": "./bin/tsc.js",

77 "tsserver": "./bin/tsserver.js",

78 "vite": "./bin/vite.js",

79 "vitest": "./bin/vitest.js",

80 "webpack": "./bin/webpack.js",

81 "webpack-bundle-analyzer": "./bin/webpack-bundle-analyzer.js",

82 "webpack-dev-server": "./bin/webpack-dev-server.js"

83 },

84 "scripts": {

85 "postinstall": "node ./src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 "prepare": "node ./src/scripts/generate-bin-wrappers.js"

87 },

88 "devDependencies": {

89 "@swc/types": "^0.1.28",

90 "@types/cpx": "~1.5.5",

91 "@types/debug": "^4.1.12",

92 "@types/eslint": "~9.6.1",

93 "@types/js-yaml": "^4.0.9",

94 "@types/less": "~3.0.8",

95 "@types/lodash.kebabcase": "^4.1.9",

96 "@types/lodash.memoize": "^4.1.9",

97 "@types/moment-locales-webpack-plugin": "~1.2.2",

98 "@types/webpack-assets-manifest": "~6.0.0",

99 "@types/yargs": "~17.0.35"

100 },

101 "dependencies": {

102 "@babel/preset-env": "~7.29.7",

103 "@jest/core": "~30.5.2",

104 "@jest/types": "~30.5.1",

105 "@jsdevtools/coverage-istanbul-loader": "^3.0.5",

bin/_run.jsView file

13*/ L14: const { execFileSync } = require('child_process'); L15: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/_run.jsView on unpkg · L13

src/cli/commands/clean.tsView file

1import { getPackageManager } from '@servicetitan/install'; L2: import { exec as execAsync, execSync } from 'node:child_process'; L3: import fs from 'node:fs';

High

Shell

Package source references shell execution.

src/cli/commands/clean.tsView on unpkg · L1

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView file

9// This works if eval is allowed (see CSP) L10: result = this || new Function('return this')(); L11: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView on unpkg · L9

bin/webpack.jsView file

2// Auto-generated by scripts/generate-bin-wrappers.js - wraps: webpack -> bin/webpack.js L3: require('./_run')('webpack', 'bin/webpack.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/webpack.jsView on unpkg · L2

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView file

51define: { L52: 'process.env.NODE_ENV': JSON.stringify(env.mode), L53: },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView on unpkg · L51

dist/cli/commands/clean.jsView file

63_utils.log.info(`Running: ${command}`); L64: await exec(command); L65: } catch (error) { ... L78: const npxCachePath = _nodepath.default.join(npmCacheDir, '_npx'); L79: _utils.log.info('Clearing npx cache'); L80: await _nodefs.default.promises.rm(npxCachePath, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/clean.jsView on unpkg · L63

dist/webpack/configs/dev-server-config.jsView file

•matchType = normalized_sha256 matchedPackage = @servicetitan/startup@38.1.4 matchedPath = dist/webpack/configs/dev-server-config.js matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:38.1.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/webpack/configs/dev-server-config.jsView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @servicetitan/startup@40.2.1 matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:40.2.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/_run.jsView file

13*/ L14: const { execFileSync } = require('child_process'); L15: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/_run.jsView on unpkg · L13

Findings

1 Critical5 High5 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/_run.js

HighShellsrc/cli/commands/clean.ts

HighRuntime Package Installdist/cli/commands/clean.js

HighKnown Malware Source Similaritydist/webpack/configs/dev-server-config.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/webpack.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @servicetitan/startup@40.2.2.

See all versions of @servicetitan/startup for other recorded verdicts.

Review the evidence and your use of @servicetitan/startup@40.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 21:18:34.280Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @servicetitan

Behavioral surface

Related packages

More from @servicetitan

Source & flagged code