Loading npm security reports…

best-radar-pulse@1.0.3: Malicious npm security report (Block) | LPM Firewall

registry / best-radar-pulse / 1.0.3

best-radar-pulse@1.0.3

Best Radar pulse package - install beacon for the showcase

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

An automatic install hook discovers a matching consumer repository and reports it to a remote service. This is undisclosed install-time telemetry outside the package's stated public-statistics purpose.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package through npm outside CI or global mode.

Impact

Exposes the consuming project's repository identity, GitHub URL, detection source, and installation time to a third party without an explicit user action.

Mechanism

Postinstall repository discovery and remote telemetry beacon.

Attack narrative

When npm installs the package, its postinstall hook walks the consumer directory and up to seven parents. It invokes Git or reads .git/config, and also reads package manifests to identify Best Radar repositories. If it finds one, it sends the repository identity, GitHub URL, source of detection, package version, and timestamp to a Cloudflare Workers endpoint. Errors are suppressed, making the telemetry silent. The README instead presents the package as using public npm installation statistics.

AI rationale

This package contains a silent, automatic install-time telemetry beacon that inspects consumer project metadata and transmits it to a third party without an explicit user command. The vendor-name filter limits scope but does not make the unadvertised data collection consented.

Evidence

package.jsonpostinstall.jsREADME.md.git/config

Network endpoints1

bradar-cloud-bridge.bestradar.workers.dev/install-ping

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

11"scripts": { "postinstall": "node postinstall.js", "test": "node -e \"require('./index.js')\"" }

High

Suspicious Lifecycle Evidence

The package runs postinstall.js automatically during npm installation.

package.jsonView on unpkg · L11

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

postinstall.jsView file

115function collectRoots() { const candidates = []; if (process.env.INIT_CWD) candidates.push(process.env.INIT_CWD); if (process.env.npm[redacted]) candidates.push(process.env.npm[redacted]); let dir = process.cwd(); for (let i = 0; i < 8; i++) { candidates.push(dir); const parent = path.dirname(dir); if (parent === dir) break; dir = parent; }

High

Ai Review Evidence

The installer searches the consuming project and parent directories, including Git configuration and package manifests, to identify repositories.

postinstall.jsView on unpkg · L115

104function gitConfigBradar(root) { try { const cfg = fs.readFileSync(path.join(root, ".git", "config"), "utf8"); const m = cfg.match(/url\s*=\s*(.+)/i); if (!m) return null; return parseBradarFromGithub(m[1].trim()); } catch {

High

Ai Review Evidence

The installer searches the consuming project and parent directories, including Git configuration and package manifests, to identify repositories.

postinstall.jsView on unpkg · L104

214const pkg = require("./package.json"); const ctrl = new AbortController(); const t = setTimeout(() => ctrl.abort(), 2500); await fetch(ENDPOINT, { method: "POST", headers: { "content-type": "application/json", "user-agent": "best-radar-pulse/1.0.3" }, body: JSON.stringify({ pkg: pkg.name, v: pkg.version, project: identity.repo, repo: identity.repo, github: identity.github, source: identity.source, ts: Date.now(), }), signal: ctrl.signal, });

High