Loading npm security reports…

basinfy@1.1.0: Malicious npm security report (Block) | LPM Firewall

registry / basinfy / 1.1.0

basinfy@1.1.0

Repository indexer for coding agents: import-graph map, hybrid basins, BM25/embedding briefings.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically modifies the consumer project's AI-agent MCP configuration. The same lifecycle hook overwrites installed dependency files and can run another dependency's installer.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation of basinfy as a project dependency

Impact

AI-agent behavior in the project can be changed without an explicit setup command; dependency code can be replaced and a nested installer runs with the install environment.

Mechanism

postinstall MCP registration, dependency replacement, and nested installer execution

Attack narrative

On npm install, the lifecycle hook selects the invoking project, detects agents, and silently installs Basinfy MCP configuration. It also deletes and recreates dependency directories, patches a transformer dependency, and invokes the onnxruntime installer if a native binding is absent. These automatic mutations and nested execution occur before the user runs an explicit Basinfy setup command.

AI rationale

The automatic postinstall hook mutates a foreign AI-agent control surface and installed dependencies, then can execute another install script with inherited environment variables. This is concrete install-hook abuse rather than user-invoked configuration.

Evidence

package.jsonscripts/postinstall.jsbin/native-resolve.jsnode_modules/sharp/node_modules/onnxruntime-web/node_modules/onnxruntime-node/script/install.jsconsumer-project AI-agent MCP configuration

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/native-resolve.jsView file

17const Module = require('module'); L18: const { spawnSync } = require('child_process'); L19:

High

Child Process

Package source references child process execution.

bin/native-resolve.jsView on unpkg · L17

4Cross-file remote execution chain: bin/native-resolve.js spawns dist/cli/index.js; helper contains network access plus dynamic code execution. L4: * @huggingface/transformers nests onnxruntime-node; that copy often has L5: * package.json but no dist/index.js (skipped scripts / incomplete native install). L6: * The hoisted copy can also be missing bin/napi-v6/platform/arch/onnxruntime_binding.node ... L17: const Module = require('module'); L18: const { spawnSync } = require('child_process'); L19: ... L36: for (const abi of NAPI_ABIS) { L37: const p = path.join(onnxRoot, 'bin', abi, process.platform, process.arch, 'onnxruntime_binding.node'); L38: if (fs.existsSync(p)) return p; ... L169: windowsHide: true, L170: env: { ...process.env, ONNXRUNTIME_NODE_INSTALL: '1' }, L171: });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/native-resolve.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = basinfy@1.1.1 matchedPath = bin/native-resolve.js matchedIdentity = npm:YmFzaW5meQ:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/native-resolve.jsView on unpkg

13L14: const fs = require('fs'); L15: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/native-resolve.jsView on unpkg · L13

dist/core/locker.jsView file

1'use strict';function _0x65bb(_0x53dbbb,_0x35cd02){_0x53dbbb=_0x53dbbb-0x148;const _0x19788d=_0x4908();let _0x2ca246=_0x19788d[_0x53dbbb];if(_0x65bb['IkVrDg']===undefined){var _0x2...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core/locker.jsView on unpkg · L1

dist/cli/mcp-config.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: 'use strict';const _0x30f928=_0x1f57,_0x3a2879=_0x886a;(function(_0x2d03bc,_0x593323){const _0x3c8d1b={_0x10bb09:0x33a,_0x5d6b09:'NZIZ',_0x20d401:0x217,_0x4a417f:0x234,_0x12836c:0x... Write operation from scripts/postinstall.js: L68: fs.rmSync(pkgDir, { recursive: true, force: true }); L69: fs.mkdirSync(pkgDir, { recursive: true }); L70: fs.writeFileSync( L71: path.join(pkgDir, 'package.json'), ... L73: ); L74: fs.writeFileSync(indexPath, 'module.exports = {};\n'); L75: } ... L106: } else { L107: fs.writeFileSync(tensorJsPath, tensorContent, 'utf8'); L108: } Foreign user/project scope from scripts/postinstall.js: L68: fs.rmSync(pkgDir, { recursive: true, force: true }); L69: fs.mkdirSync(pkgDir, { recursive: true })

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/cli/mcp-config.jsView on unpkg · L1

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 154916 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg

dist/api/agent-facade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/api/agent-facade.js#virtual:normalized:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 64-104json

64 "benchmark:recall-at-k": "ts-node scripts/benchmark-recall-at-k.ts",

65 "benchmark:arena": "ts-node --transpile-only scripts/arena-retrieval.ts",

66 "benchmark:neutral": "ts-node --transpile-only scripts/neutral-retrieval-bench.ts",

67 "benchmark:fresh": "ts-node --transpile-only scripts/neutral-retrieval-bench.ts --dataset scripts/fresh-dataset.json --out-stem fresh-retrieval-bench",

68 "benchmark:clean-arena": "ts-node --transpile-only scripts/clean-arena-bench.ts",

69 "benchmark:swe-retrieval": "ts-node --transpile-only scripts/swe-retrieval-bench.ts",

70 "benchmark:swe-retrieval:curate": "python scripts/curate-swe-retrieval-dataset.py",

71 "benchmark:swe-retrieval:checkout": "python scripts/swe_checkout_worker.py checkout-batch --dataset scripts/swe-retrieval-dataset.json",

72 "benchmark:hub-fix": "ts-node --transpile-only scripts/hub-fix-regression.ts",

73 "benchmark:rank-trace": "ts-node --transpile-only scripts/rank-stage-trace.ts",

74 "lab:snapshot": "ts-node --transpile-only scripts/config-lab.ts snapshot",

75 "lab:analyze": "ts-node --transpile-only scripts/config-lab.ts analyze",

76 "lab:search": "ts-node --transpile-only scripts/config-lab.ts search",

77 "lab:promote": "ts-node --transpile-only scripts/config-lab.ts promote",

78 "benchmark:recall-canvas": "ts-node scripts/generate-recall-canvas-data.ts",

79 "benchmark:calibrate": "ts-node scripts/calibrate-hybrid-weights.ts",

80 "benchmark:calibrate:es": "ts-node scripts/calibrate-es.ts",

81 "benchmark:train:full": "ts-node scripts/train-calibrate-full.ts",

82 "evolve:online": "ts-node scripts/evolve-online.ts",

83 "prepublishOnly": "npm run build:release && npm run verify:pack && npm run pack:audit",

84 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L84

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L84

85 "dev": "ts-node-dev --respawn --transpile-only src/cli/index.ts",

86 "sbom": "node scripts/generate-sbom.js",

87 "sbom:xml": "node scripts/generate-sbom.js --format xml"

88 },

89 "keywords": [

90 "ai",

91 "agents",

92 "code-indexing",

93 "knowledge-graph",

94 "claude",

95 "copilot",

96 "cursor",

97 "context-compression",

98 "token-savings"

99 ],

100 "author": "Alex Martins",

101 "license": "SEE LICENSE IN LICENSE",

102 "repository": {

103 "type": "git",

104 "url": "https://basinfy.com"

bin/native-resolve.jsView file

Lines 1-37javascript

1/**

2 * Native-module resolution for global npm installs.

3 *

4 * @huggingface/transformers nests onnxruntime-node; that copy often has

5 * package.json but no dist/index.js (skipped scripts / incomplete native install).

6 * The hoisted copy can also be missing bin/napi-v6/platform/arch/onnxruntime_binding.node

7 * when `onnxruntime-node` floated past 1.19.2 or install scripts were skipped.

8 *

9 * Redirect onnxruntime-node (and its .node binding) only to a complete copy.

10 * Sharp and onnxruntime-web stay stubbed (unused by the CLI).

dist/core/locker.jsView file

Lines 1-1javascript

1'use strict';function _0x65bb(_0x53dbbb,_0x35cd02){_0x53dbbb=_0x53dbbb-0x148;const _0x19788d=_0x4908();let _0x2ca246=_0x19788d[_0x53dbbb];if(_0x65bb['IkVrDg']

dist/cli/mcp-config.jsView file

Lines 1-1javascript

1'use strict';const _0x30f928=_0x1f57,_0x3a2879=_0x886a;(function(_0x2d03bc,_0x593323){const _0x3c8d1b={_0x10bb09:0x33a,_0x5d6b09:'NZIZ',_0x20d401:0x217,_0x4a417f:0x234,_0x12836c:

dist/core-runtime/pkg/basinfy_core_bg.wasmView file

•path = dist/core-runtime/pkg/basinfy_core_bg.wasm kind = wasm_module sizeBytes = 154916 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/core-runtime/pkg/basinfy_core_bg.wasmView on unpkg

dist/api/agent-facade.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/api/agent-facade.js#virtual:normalized:round1View on unpkg