codeplay-common@4.7.2
Common build scripts and files
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe preinstall hook performs unconsented deletion in the consumer project, including broad directory removal and matching root-level files without ownership checks. This concrete destructive lifecycle behavior warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing codeplay-common through npm, which runs its preinstall hook.
Impact
Consumer project files and directory contents that match these targets can be irreversibly deleted during installation.
Mechanism
The hook executes scripts/uninstall.js, which resolves the consumer root, scans it for matching files, unlinks them, and recursively removes buildCodeplay and splashxml directories.
Attack narrative
During npm installation, the preinstall hook runs cleanup against the consumer project root. It removes matching files, including .env.storeid files and finalrelease-prefixed files, and recursively deletes buildCodeplay and splashxml. The source does not verify that these targets were created by this package before deleting them.
AI rationale
The preinstall hook performs unconsented deletion in the consumer project, including broad directory removal and matching root-level files without ownership checks. This concrete destructive lifecycle behavior warrants blocking publication.
Evidence
package.jsonscripts/uninstall.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The build script invokes an agent-instructions updater that targets AGENTS.md and the AGENTS directory.
- package.json runs scripts/uninstall.js during preinstall.
- The preinstall script resolves the consumer project root and defines cleanup patterns that include .env.storeid files and files beginning with finalrelease.
- The script enumerates files in the consumer root and unlinks every file matching those patterns.
- The preinstall script also recursively removes the consumer's buildCodeplay and splashxml directories.
Evidence against
- The postinstall script copies package assets into the consumer project and adds build-related scripts, which is consistent with the package's stated build-tools purpose.
- The agent-instructions updater is called by a build script, rather than by either install hook.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node scripts/uninstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgfiles/generate-ai-promo-video.jsView file
17const { createHash } = require('node:crypto');
L18: const { spawnSync } = require('node:child_process');
L19: const { createInterface } = require('node:readline/promises');
High
Child Process
Package source references child process execution.
files/generate-ai-promo-video.jsView on unpkg · L1717const { createHash } = require('node:crypto');
L18: const { spawnSync } = require('node:child_process');
L19: const { createInterface } = require('node:readline/promises');
L20:
L21: const projectDirectory = __dirname;
L22: const capacitorConfigPath = path.join(projectDirectory, 'capacitor.config.json');
L23: const capacitorConfig = JSON.parse(fs.readFileSync(capacitorConfigPath, 'utf8'));
L24: const appName = String(capacitorConfig.appName || '').trim();
...
L41: const appFilePrefix = `${appUniqueId}. ${sanitizeFileNamePart(appName)}`;
L42: const playStoreDownloadUrl = `https://play.google.com/store/apps/details?id=${encodeURIComponent(packageId)}`;
L43: const configuredAppStoreUrl = String(iosStoreConfig.appStoreUrl || '')
...
L88: const promoCopyResultPath = path.join(temporaryDir
Findings
1 Critical8 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltafiles/buildCodeplay/codeplayBeforeBuild-6.3.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processfiles/generate-ai-promo-video.js
HighShell
HighRuntime Package Installfiles/buildCodeplay/codeplayBeforeBuild-6.3.js
HighSemantic Analysis Limitedfiles/buildCodeplay/codeplayBeforeBuild-6.3.js
HighKnown Malware Source Similarityfiles/iap-install-2.js
HighKnown Malware Source Similarityfiles/buildCodeplay/manifestModification.js
HighKnown Malware Source Similarityfiles/scripts/setup-baseline-profile.js
MediumDynamic Requirescripts/sync-files.js
MediumNetwork
Affected versions and remediation
This report applies to codeplay-common@4.7.2.
See all versions of codeplay-common for other recorded verdicts.
- Avoid installing codeplay-common@4.7.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.