@yes20sh/ts-node-express@1.0.5
TypeScript Express CRUD API with Database
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe postinstall hook performs unconsented project mutations, including overwriting tsconfig.json, and starts a detached delayed updater. The behavior resembles project scaffolding and no exfiltration or agent-control mutation was found, so warn rather than block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation runs the postinstall hook.
Impact
Consumer project configuration and files may be changed without an explicit setup command; the delayed process can continue after installation finishes.
Mechanism
The hook overwrites tsconfig.json, rewrites package.json with default project scripts and dependencies, and starts a detached process that revisits project files after a delay.
AI rationale
The postinstall hook performs unconsented project mutations, including overwriting tsconfig.json, and starts a detached delayed updater. The behavior resembles project scaffolding and no exfiltration or agent-control mutation was found, so warn rather than block.
Evidence
package.jsonscripts/postinstall.jstsconfig.json
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs scripts/postinstall.js automatically during installation.
- The hook targets the invoking project and overwrites its tsconfig.json when present.
- It rewrites the consumer package.json and later starts a detached updater that revisits project files.
Evidence against
- The hook adds scaffold files and default scripts and dependencies consistent with a project setup utility.
- The inspected source shows no network endpoint, credential collection, or AI-agent control-surface mutation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg12"postinstall": "node scripts/postinstall.js",
"start": "node dist/server.js",
"dev": "tsx wa
Medium
Suspicious Lifecycle Evidence
package.json runs scripts/postinstall.js automatically during installation.
package.jsonView on unpkg · L12scripts/postinstall.jsView file
Findings
2 High6 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltascripts/postinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencescripts/postinstall.js
MediumAi Review Evidencescripts/postinstall.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @yes20sh/ts-node-express@1.0.5.
See all versions of @yes20sh/ts-node-express for other recorded verdicts.
- Review the evidence and your use of @yes20sh/ts-node-express@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.