codeplay-common@4.5.0
Common build scripts and files
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe automatic preinstall hook performs destructive deletion in the consumer project, including recursive removal of a whole directory. This concrete install-time behavior supports blocking the package.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package with npm, which runs its preinstall hook.
Impact
Project files in those locations are deleted before installation completes; the postinstall hook also copies package files and rewrites the project's package.json.
Mechanism
scripts/uninstall.js recursively removes buildCodeplay and splashxml and unlinks files matching configured build and plugin patterns.
Attack narrative
The package's npm preinstall hook invokes cleanup code that recursively deletes the consumer project's buildCodeplay directory and removes additional matching files from the project root. This can destroy project content during installation. The postinstall hook also copies package files into the project and rewrites its package.json.
AI rationale
The automatic preinstall hook performs destructive deletion in the consumer project, including recursive removal of a whole directory. This concrete install-time behavior supports blocking the package.
Evidence
package.jsonscripts/uninstall.jsscripts/sync-files.js
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json automatically runs scripts/uninstall.js during preinstall and scripts/sync-files.js during postinstall.
- The preinstall script recursively deletes the consumer project's buildCodeplay directory, including its contents, and also removes a splashxml directory.
- The same preinstall script deletes root-level files matching several build and plugin filename patterns.
- The postinstall script copies package files into the project root and writes modified contents to the consumer's package.json.
Evidence against
- The cleanup targets named build and plugin artifacts, which is consistent with removing files from an earlier package setup, but it also removes the entire buildCodeplay directory recursively.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node scripts/uninstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgfiles/generate-ai-promo-video.jsView file
7const { createHash } = require('node:crypto');
L8: const { spawnSync } = require('node:child_process');
L9:
High
Child Process
Package source references child process execution.
files/generate-ai-promo-video.jsView on unpkg · L7•matchType = normalized_sha256
matchedPackage = codeplay-common@4.4.6
matchedPath = files/generate-ai-promo-video.js
matchedIdentity = npm:Y29kZXBsYXktY29tbW9u:4.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
1 Critical9 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltafiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processfiles/generate-ai-promo-video.js
HighShell
HighRuntime Package Installfiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighSemantic Analysis Limitedfiles/buildCodeplay/codeplayBeforeBuild-6.2.js
HighKnown Malware Source Similarityfiles/generate-ai-promo-video.js
HighKnown Malware Source Similarityfiles/iap-install-2.js
HighKnown Malware Source Similarityfiles/buildCodeplay/manifestModification.js
HighKnown Malware Source Similarityfiles/scripts/setup-baseline-profile.js
Medium
Affected versions and remediation
This report applies to codeplay-common@4.5.0.
See all versions of codeplay-common for other recorded verdicts.
- Avoid installing codeplay-common@4.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.