Loading npm security reports…

botfork@0.2.37: Malicious npm security report (Block) | LPM Firewall

registry / botfork / 0.2.37

botfork@0.2.37

Connect to the botfork TUI server over SSH — nothing to install locally.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Installation automatically runs a disguised Node helper that can compile and launch a detached local SSH server. It writes persistent server state outside the package directory.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install, including a non-interactive install.

Impact

An install modifies user home configuration and cache paths and launches a background process without an interactive user's approval.

Mechanism

Lifecycle hook launches a disguised helper that builds and starts a background binary.

Attack narrative

The package uses preinstall and postinstall hooks. In automated installs, preinstall explicitly bypasses its consent prompt. Postinstall then launches a helper disguised as a text file. The helper compiles bundled Go source, writes cache and configuration files in the user home directory, and starts a detached SSH server. These install-time effects occur without a user command and exceed ordinary package setup.

AI rationale

Automatic lifecycle execution bypasses consent in non-interactive contexts and launches a concealed helper that builds and persists a background service outside the package. This is concrete install-hook abuse.

Evidence

package.jsonlib/preinstall.jslib/postinstall.jsBotFork Shortcut.txtserver-src/~/.cache/botfork/botfork~/.cache/botfork/server.pid~/.cache/botfork/server.log~/.config/botfork/hostkey

Source & flagged code

6 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "botfork",

3 "version": "0.2.37",

4 "description": "Connect to the botfork TUI server over SSH — nothing to install locally.",

5 "bin": {

6 "botfork": "bin/botfork.js"

7 },

8 "files": [

9 "bin/",

10 "lib/",

11 "BotFork Shortcut.txt",

12 "server-src/"

13 ],

14 "engines": {

15 "node": ">=18.17.0"

16 },

17 "scripts": {

18 "preinstall": "node lib/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "postinstall": "node lib/postinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "preuninstall": "node lib/preuninstall.js",

21 "postuninstall": "node lib/postuninstall.js"

22 },

23 "keywords": [

24 "ssh",

25 "tui",

26 "terminal",

27 "botfork"

28 ],

29 "license": "MIT",

30 "repository": {

31 "type": "git",

32 "url": "https://github.com/xdbi/botfork.git"

33 }

34}

35

bin/botfork.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.36 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/botfork.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = c81fcab5d9b6784f signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = botfork@0.2.36 matchedPath = bin/botfork.js matchedIdentity = npm:Ym90Zm9yaw:0.2.36 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/botfork.jsView on unpkg

lib/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = botfork@0.2.36 matchedPath = lib/postinstall.js matchedIdentity = npm:Ym90Zm9yaw:0.2.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/postinstall.jsView on unpkg