codeplay-common@4.4.9
Common build scripts and files
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest activates an unconditional recursive deletion of consumer project directories during preinstall. This is concrete destructive install-time behavior and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm runs the package's preinstall hook during installation.
Impact
Installation can permanently delete user or project data stored in those directories.
Mechanism
scripts/uninstall.js resolves the consumer project root, then recursively unlinks files and removes the buildCodeplay and splashxml directories when present.
Attack narrative
During installation, the preinstall hook runs scripts/uninstall.js. That script recursively deletes the consumer project's buildCodeplay and splashxml directories without checking which files are package-owned, so unrelated project content in either directory can be lost.
AI rationale
The manifest activates an unconditional recursive deletion of consumer project directories during preinstall. This is concrete destructive install-time behavior and warrants blocking publication.
Evidence
package.jsonscripts/uninstall.jsconsumer project root/buildCodeplayconsumer project root/splashxml
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/uninstall.js as a preinstall lifecycle hook.
- The preinstall script recursively deletes the consumer project's buildCodeplay and splashxml directories, including their files and subdirectories.
- The deletion is unconditional when those directories exist; the cleanup does not check whether their contents belong to this package.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node scripts/uninstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgfiles/generate-ai-promo-video.jsView file
7const { createHash } = require('node:crypto');
L8: const { spawnSync } = require('node:child_process');
L9:
High
Child Process
Package source references child process execution.
files/generate-ai-promo-video.jsView on unpkg · L7•matchType = normalized_sha256
matchedPackage = codeplay-common@4.4.6
matchedPath = files/generate-ai-promo-video.js
matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 Critical10 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltafiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processfiles/generate-ai-promo-video.js
HighShell
HighRuntime Package Installfiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighSemantic Analysis Limitedfiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighKnown Malware Source Similarityfiles/generate-ai-promo-video.js
HighKnown Malware Source Similarityfiles/iap-install-2.js
HighKnown Malware Source Similarityfiles/take-screen-image.js
HighKnown Malware Source Similarityfiles/buildCodeplay/manifestModification.js
High
Affected versions and remediation
This report applies to codeplay-common@4.4.9.
See all versions of codeplay-common for other recorded verdicts.
- Avoid installing codeplay-common@4.4.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.