registry / @windmill-labs/components / 1.764.0
@windmill-labs/components@1.764.0
The Windmill frontend written in Svelte 5 + Tailwind CSS
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect inspection contradicts the lifecycle-script alert: the referenced helper is not present, so installation has no resulting command execution. Runtime network behavior is package-aligned Copilot functionality and no concrete malicious chain was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm install evaluates the guarded postinstall; Copilot package search is explicitly invoked at runtime.
Impact
No filesystem mutation, command execution, persistence, or credential exfiltration established.
Mechanism
Absent-helper guard; user-invoked package metadata lookup.
AI rationale
Direct inspection contradicts the lifecycle-script alert: the referenced helper is not present, so installation has no resulting command execution. Runtime network behavior is package-aligned Copilot functionality and no concrete malicious chain was found.
Evidence
package.jsonpackage/components/copilot/chat/shared.jspackage/components/copilot/chat/script/core.jspackage/components/copilot/lib.jspackage/script_helpers.js
Network endpoints2
registry.npmjs.orgunpkg.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json postinstall only runs a helper if it exists; scripts/untar_ui_builder.js is absent.
- No shipped source uses child_process, execSync, eval, or environment harvesting; matches are templates/comments.
- package/components/copilot/chat/shared.js contains UI/chat formatting and flow helpers, not install-time execution.
- package/components/copilot/chat/script/core.js network requests are user-invoked npm package/documentation lookup.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
CopyleftLicense
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node -e "if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgpackage.json#scripts.postinstallView file
1if (require('fs').existsSync('./scripts/untar_ui_builder.js')) { require('child_process').execSync('node ./scripts/untar_ui_builder.js', {stdio: 'inherit'}) }
Findings
2 Critical2 High5 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltapackage/components/copilot/chat/shared.js
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencepackage/script_helpers.js
MediumDynamic Requirepackage.json#scripts.postinstall
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpackage/components/copilot/prompts/yaml2json.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @windmill-labs/components@1.764.0.
See all versions of @windmill-labs/components for other recorded verdicts.
- Review the evidence and your use of @windmill-labs/components@1.764.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.