@yes20sh/ts-node-express@1.0.7
TypeScript Express CRUD API with Database
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe lifecycle hook performs broad, unconsented writes in the installing project and repeats them from a detached process. This is concrete install-time project mutation, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installing the package through a package manager that runs its postinstall hook.
Impact
Consumer project files and configuration can be unexpectedly added or overwritten.
Mechanism
The hook targets INIT_CWD, PWD, or the current directory, copies package files, then writes a rebuilt package.json and schedules delayed setup.
Attack narrative
During installation, the package's postinstall hook targets the consumer project. It copies source and template files, rewrites package.json, and launches a detached delayed setup process. This is an automatic mutation of the consumer project without a consent guard in the inspected hook.
AI rationale
The lifecycle hook performs broad, unconsented writes in the installing project and repeats them from a detached process. This is concrete install-time project mutation, so the package should be blocked.
Evidence
package.jsonscripts/postinstall.jsscripts/delayed-setup.jssrctsconfig.json.env.gitignore.prettierrcREADME.md
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/postinstall.js automatically after installation.
- The hook targets the invoking project directory and runs setup when it differs from the package directory.
- Setup copies package files into the consumer project and rewrites its package.json.
- The hook starts a detached process to repeat setup after the package manager finishes.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg9"scripts": {
"build": "tsc",
"prepublishOnly": "npm run build",
"postinstall": "node scripts/postinstall.js",
"start": "node dist/server.js",
"dev": "tsx watc
High
Suspicious Lifecycle Evidence
package.json runs scripts/postinstall.js automatically after installation.
package.jsonView on unpkg · L9•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.jsView file
Findings
5 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltascripts/postinstall.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencescripts/postinstall.js
HighAi Review Evidencescripts/delayed-setup.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @yes20sh/ts-node-express@1.0.7.
See all versions of @yes20sh/ts-node-express for other recorded verdicts.
- Avoid installing @yes20sh/ts-node-express@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.