cloud-pc-templates-marketplace@1.4.3
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe server performs a destructive file deletion during startup, before loading the database. The manifest has no install hook, so the finding is limited to running the vector server.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running misc/vectorDb/vectorDbServer.js.
Impact
Previously persisted vector data can be lost each time the server starts.
Mechanism
Startup calls file deletion on PERSIST_PATH, whose default is a local vector data file.
Attack narrative
When the vector database server starts, it deletes the configured persistence file before constructing the database. This can erase previously saved vectors on every startup.
AI rationale
The server performs a destructive file deletion during startup, before loading the database. The manifest has no install hook, so the finding is limited to running the vector server.
Evidence
misc/vectorDb/vectorDbServer.js
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The vector database server unconditionally deletes its configured persistence file during startup, before the database is created.
- The vector database server starts listening and runs initialization when the file is executed.
- The package manifest declares no install lifecycle hook.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedmisc/vectorDb/vectorDbServer.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = cloud-pc-templates-marketplace@1.3.0
matchedIdentity = npm:[redacted]:1.3.0
similarity = 0.875
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
misc/vectorDb/vectorDbServer.jsView on unpkg6const https = require('https');
L7: const { execFile, execSync } = require('child_process');
L8: const { URL } = require('url');
High
Child Process
Package source references child process execution.
misc/vectorDb/vectorDbServer.jsView on unpkg · L6JS-AGENTS/angularConnector.jsView file
173
Findings
1 Critical5 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltamisc/vectorDb/vectorDbServer.js
HighChild Processmisc/vectorDb/vectorDbServer.js
HighShellJS-AGENTS/angularConnector.js
HighRuntime Package InstallJS-AGENTS/angularConnector.js
HighShips High Entropy BlobJS-AGENTS/sqlConnector.zip
HighSemantic Analysis LimitedJS-AGENTS/sqlConnector/sqlConnector.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpermisc/whisper-server.py
MediumShips Compressed BlobJS-AGENTS/sqlConnector.zip
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to cloud-pc-templates-marketplace@1.4.3.
See all versions of cloud-pc-templates-marketplace for other recorded verdicts.
- Avoid installing cloud-pc-templates-marketplace@1.4.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.