codeplay-common@4.3.5
Common build scripts and files
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe preinstall hook performs unconsented recursive deletion of consumer project directories and files, supporting a malicious destructive-action finding. Postinstall adds further project-root copying and script changes; agent instruction synchronization is a later build-time action.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm, which activates its preinstall and postinstall hooks.
Impact
Existing project content can be irreversibly removed or overwritten, and project build scripts can be replaced.
Mechanism
The preinstall script removes the project’s buildCodeplay and splashxml trees and matching root files; the postinstall script copies bundled assets and writes the consumer package manifest.
Attack narrative
During npm installation, the preinstall hook recursively deletes the consumer project's buildCodeplay and splashxml directories and removes files matching several root-level patterns. The postinstall hook then copies bundled files into the project root and rewrites package scripts. These automatic project-wide mutations establish a destructive install-time attack surface.
AI rationale
The preinstall hook performs unconsented recursive deletion of consumer project directories and files, supporting a malicious destructive-action finding. Postinstall adds further project-root copying and script changes; agent instruction synchronization is a later build-time action.
Evidence
package.jsonscripts/uninstall.jsscripts/sync-files.js
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The preinstall hook runs scripts/uninstall.js automatically.
- That script recursively deletes the consumer project's buildCodeplay and splashxml directories and removes matching root files.
- The postinstall hook copies package files into the project root and rewrites the consumer package.json scripts.
- The builder names AGENTS.md and AGENTS as agent instruction assets; it synchronizes them later when the build script runs.
Evidence against
- Agent instruction synchronization runs from the builder's main function, not directly from either lifecycle script.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/sync-files.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgfiles/buildCodeplay/apk-store-builder.jsView file
1const { spawn } = require("child_process");
L2: const path = require("path");
High
Child Process
Package source references child process execution.
files/buildCodeplay/apk-store-builder.jsView on unpkg · L1scripts/sync-files.jsView file
1const fs = require("fs");
L2: const path = require("path");
Medium
Findings
1 Critical9 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltafiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processfiles/buildCodeplay/apk-store-builder.js
HighShell
HighCommand Output Exfiltrationfiles/take-screen-image.js#virtual:normalized:round1
HighRuntime Package Installfiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighSemantic Analysis Limitedfiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighKnown Malware Source Similarityfiles/iap-install-2.js
HighKnown Malware Source Similarityfiles/buildCodeplay/manifestModification.js
HighKnown Malware Source Similarityfiles/scripts/setup-baseline-profile.js
Affected versions and remediation
This report applies to codeplay-common@4.3.5.
See all versions of codeplay-common for other recorded verdicts.
- Avoid installing codeplay-common@4.3.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.