registry / Destructive action / codeplay-common
codeplay-common
Common build scripts and files
This report shows the evidence for codeplay-common@4.8.1. 9 of 53 known versions are blocked or flagged. The newest version, 4.9.9, is flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest activates a preinstall script that recursively deletes directories in the consumer project, establishing concrete unconsented destructive behavior. The postinstall project setup does not reduce that risk.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An npm installation that runs this package’s preinstall hook.
Impact
Existing build configuration and other files inside those directories can be irreversibly deleted.
Mechanism
The hook resolves the consumer project root, then recursively removes the named project directories and their contents.
Attack narrative
During npm installation, the preinstall hook runs scripts/uninstall.js. That script resolves the consumer project root and recursively deletes its buildCodeplay and splashxml directories, without a consent check. The separate postinstall hook also copies package files into the project and rewrites its package.json, but the blocking finding is the automatic destructive cleanup.
AI rationale
The manifest activates a preinstall script that recursively deletes directories in the consumer project, establishing concrete unconsented destructive behavior. The postinstall project setup does not reduce that risk.
Evidence
package.jsonscripts/uninstall.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest automatically runs scripts/uninstall.js during preinstall.
- The cleanup script resolves the consumer project root and recursively deletes the buildCodeplay directory and its contents.
- The postinstall script copies package files into the consumer project and rewrites its package.json.
- The inspected agent-instructions location contains filename constants; this review does not rely on it as evidence of the install-time attack.
Evidence against
- The postinstall copy and package.json changes appear intended to configure this package’s build tooling, but do not mitigate the separate preinstall deletion.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node scripts/uninstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgfiles/generate-ai-promo-video.jsView file
17const { createHash } = require('node:crypto');
L18: const { spawnSync } = require('node:child_process');
L19: const { createInterface } = require('node:readline/promises');
High
Child Process
Package source references child process execution.
files/generate-ai-promo-video.jsView on unpkg · L1717const { createHash } = require('node:crypto');
L18: const { spawnSync } = require('node:child_process');
L19: const { createInterface } = require('node:readline/promises');
L20:
L21: const projectDirectory = __dirname;
L22: const capacitorConfigPath = path.join(projectDirectory, 'capacitor.config.json');
L23: const capacitorConfig = JSON.parse(fs.readFileSync(capacitorConfigPath, 'utf8'));
L24: const appName = String(capacitorConfig.appName || '').trim();
...
L41: const appFilePrefix = `${appUniqueId}. ${sanitizeFileNamePart(appName)}`;
L42: const playStoreDownloadUrl = `https://play.google.com/store/apps/details?id=${encodeURIComponent(packageId)}`;
L43: const configuredAppStoreUrl = String(iosStoreConfig.appStoreUrl || '')
...
L88: const promoCopyResultPath = path.join(temporaryDir
Findings
1 Critical8 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltafiles/buildCodeplay/codeplayBeforeBuild-6.4.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processfiles/generate-ai-promo-video.js
HighShell
HighRuntime Package Installfiles/buildCodeplay/codeplayBeforeBuild-6.4.js
HighSemantic Analysis Limitedfiles/buildCodeplay/setSplashAnimation-1.4.js
HighKnown Malware Source Similarityfiles/iap-install-2.js
HighKnown Malware Source Similarityfiles/buildCodeplay/manifestModification.js
HighKnown Malware Source Similarityfiles/scripts/setup-baseline-profile.js
MediumDynamic Requirescripts/sync-files.js
MediumNetwork
Affected versions and remediation
This report applies to codeplay-common@4.8.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing codeplay-common@4.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.