registry / codeplay-common / 4.1.9

codeplay-common@4.1.9

Common build scripts and files

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Install rewrites the consuming project's build configuration and copies build tooling. A later user build fetches unverified remote plugin payloads and writes them into project source.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install activates lifecycle scripts; the rewritten build command activates remote update logic.

Impact

Remote server content can alter application source used by future builds; no confirmed credential theft or host compromise is present in the inspected source.

Mechanism

project mutation plus unauthenticated live plugin download

Rationale

The package is intrusive and permits a remote endpoint to change build inputs, warranting a warning. Source inspection does not establish malicious intent or a concrete exploit payload.

Evidence

package.jsonscripts/uninstall.jsscripts/sync-files.jsfiles/buildCodeplay/codeplayBeforeBuild-6.2.jsfiles/iap-install-2.jsbuildCodeplay/scripts/setup-baseline-profile.jssrc/android/ios/

Network endpoints2

htmlcodeplay.com/code-play-plugin/versions.jsonhtmlcodeplay.com/code-play-plugin/

codeplay-common@4.1.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code