registry / Install hook abuse / best-radar-pulse
best-radar-pulse
Best Radar pulse package - install beacon for the showcase
This report shows the evidence for best-radar-pulse@1.0.3, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package contains a silent, automatic install-time telemetry beacon that inspects consumer project metadata and transmits it to a third party without an explicit user command. The vendor-name filter limits scope but does not make the unadvertised data collection consented.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package through npm outside CI or global mode.
Impact
Exposes the consuming project's repository identity, GitHub URL, detection source, and installation time to a third party without an explicit user action.
Mechanism
Postinstall repository discovery and remote telemetry beacon.
Attack narrative
When npm installs the package, its postinstall hook walks the consumer directory and up to seven parents. It invokes Git or reads .git/config, and also reads package manifests to identify Best Radar repositories. If it finds one, it sends the repository identity, GitHub URL, source of detection, package version, and timestamp to a Cloudflare Workers endpoint. Errors are suppressed, making the telemetry silent. The README instead presents the package as using public npm installation statistics.
AI rationale
This package contains a silent, automatic install-time telemetry beacon that inspects consumer project metadata and transmits it to a third party without an explicit user command. The vendor-name filter limits scope but does not make the unadvertised data collection consented.
Evidence
package.jsonpostinstall.jsREADME.md.git/config
Network endpoints1
bradar-cloud-bridge.bestradar.workers.dev/install-ping
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs postinstall.js automatically during npm installation.
- The installer searches the consuming project and parent directories, including Git configuration and package manifests, to identify repositories.
- The install hook silently sends the detected repository identity and install metadata to a third-party endpoint.
- The README advertises public npm statistics, while the source implements an undisclosed install-time network beacon.
Evidence against
- The beacon limits reporting to repositories matching the Best Radar naming pattern.
- The inspected code does not read credentials, write files, download code, or execute remote payloads.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg11"scripts": {
"postinstall": "node postinstall.js",
"test": "node -e \"require('./index.js')\""
}
High
Suspicious Lifecycle Evidence
The package runs postinstall.js automatically during npm installation.
package.jsonView on unpkg · L11•scripts.postinstall = node postinstall.js
Medium
Findings
6 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedpackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencepostinstall.js
HighAi Review Evidencepostinstall.js
HighSuspicious Lifecycle Evidencepostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to best-radar-pulse@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing best-radar-pulse@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.