Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

botfork@0.2.34: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / botfork / 0.2.34

botfork@0.2.34

Connect to the botfork TUI server over SSH — nothing to install locally.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installation automatically executes a helper described as a dry run. Its default path builds and launches a detached local SSH service, then connects to it.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes postinstall.

Impact

An install can modify user configuration and cache directories, create a detached process, and invoke Go and SSH without an explicit botfork command.

Mechanism

Install-time helper execution starts a local compiled service and writes user-home state.

AI rationale

The claimed dry-run behavior contradicts the helper's default execution path, producing meaningful install-hook risk. Static source does not establish theft, remote payload execution, or a package-controlled network endpoint.

Evidence

package.jsonlib/postinstall.jsBotFork Shortcut.txtserver-src/~/.config/botfork/hostkey~/.cache/botfork/botfork~/.cache/botfork/server.log~/.cache/botfork/server.pid

Network endpoints1

127.0.0.1:2222

Decision evidence

public snapshot

Stop threats before they install.

Firewall

Threat feed
How it works
Policy

LPM

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install lifecycle hooks run a Node postinstall script.
Postinstall launches the bundled helper with BOTFORK_PROBE enabled despite calling it a dry run.
The helper's default path builds a Go binary, starts a detached service, and attempts an SSH connection.
The helper writes host-key, cache, log, and PID state under the user's home directories.

Evidence against

The default service address is loopback and the Go server rejects unauthenticated non-loopback binds.
No source path inspected sends harvested credentials or files to a package-controlled endpoint.
Tool cloning is behind an explicit user command.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 11.6 KB of source

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node lib/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node lib/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

17"scripts": { "preinstall": "node lib/preinstall.js", "postinstall": "node lib/postinstall.js", "preuninstall": "node lib/preuninstall.js", "postuninstall": "node lib/postuninstall.js" },

Medium

Suspicious Lifecycle Evidence

Install lifecycle hooks run a Node postinstall script.

package.jsonView on unpkg · L17

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.37 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.37 matchedPath = lib/postinstall.js matchedIdentity = npm:Ym90Zm9yaw:0.2.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall.jsView on unpkg

Findings

3 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/botfork.js

HighKnown Malware Source Similaritylib/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to botfork@0.2.34.

See version security history for other recorded verdicts.

Review the evidence and your use of botfork@0.2.34 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 20:12:33.179Z (UTC).

91%Suspicious

AI assessment confidence

IntentDangerous Capability

TypeInstall Hook Abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainersopenmbstore

Version0.2.34

Latest on npm0.2.39

PublishedSep 11, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size86.9 KB

Files20

Keywordssshtuiterminalbotfork

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → botfork

Runtimenode >=18.17.0

Artifact375 KB · 20 files1 signature(s)

Install lifecyclepostinstallpreinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemHighEntropyStringsManifest: clean

LPM.dev Registry

© 2026 LPM

Source & flagged code

6 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "botfork",

3 "version": "0.2.34",

4 "description": "Connect to the botfork TUI server over SSH — nothing to install locally.",

5 "bin": {

6 "botfork": "bin/botfork.js"

7 },

8 "files": [

9 "bin/",

10 "lib/",

11 "BotFork Shortcut.txt",

12 "server-src/"

13 ],

14 "engines": {

15 "node": ">=18.17.0"

16 },

17 "scripts": {

18 "preinstall": "node lib/preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "postinstall": "node lib/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "preuninstall": "node lib/preuninstall.js",

21 "postuninstall": "node lib/postuninstall.js"

22 },

Medium

Suspicious Lifecycle Evidence

Install lifecycle hooks run a Node postinstall script.

package.jsonView on unpkg · L17

23 "keywords": [

24 "ssh",

25 "tui",

26 "terminal",

27 "botfork"

28 ],

29 "license": "MIT",

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/xdbi/botfork.git"

33 }

34}

35

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.37 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.37 matchedPath = lib/postinstall.js matchedIdentity = npm:Ym90Zm9yaw:0.2.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall.jsView on unpkg