Loading npm security reports…

credstore@1.0.5: Clean npm security report (Allow) | LPM Firewall

registry / credstore / 1.0.5

credstore@1.0.5

Secure Offline Credential Manager

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The install hook performs package-aligned Linux desktop launcher registration, not foreign control-surface mutation or data access.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install on Linux or explicit credstore --install-desktop

Impact

Adds/removes a CredStore launcher; no exfiltration, persistence beyond launcher registration, or remote payload execution found

Mechanism

desktop launcher registration and local Electron app launch

Rationale

The suspicious lifecycle hook is a disclosed, package-aligned desktop integration on Linux and the runtime is explicitly offline with network blocking. Source inspection did not find exfiltration, destructive behavior, remote code loading, credential harvesting, or AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall-desktop.jsbin/credstore.jselectron/main.jsout/index.htmlout/_next/static/chunks/app/page-cbf8d55a45cea371.jsREADME.md~/.local/share/applications/credstore.desktop

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json defines postinstall: node scripts/postinstall-desktop.js
scripts/postinstall-desktop.js writes Linux desktop launcher under ~/.local/share/applications and spawns update-desktop-database
bin/credstore.js can install/uninstall the same launcher and spawns Electron on user command

Evidence against

No credential/env/file harvesting or exfiltration found in inspected source
electron/main.js blocks non-local requests, denies permissions, enables sandbox/contextIsolation, and loads local out/index.html in production
out/index.html CSP sets connect-src 'none'
Built app stores encrypted vault data locally via localStorage/Capacitor Preferences and uses Web Crypto; no fetch/XMLHttpRequest/WebSocket app code found
README discloses offline design and Linux launcher postinstall behavior

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

2 flagged

package.jsonView file

Lines 22-62json

22 "CHANGELOG.md",

23 "README.md",

24 "LICENSE"

25 ],

26 "homepage": "https://github.com/LocaMartin/credstore#readme",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/LocaMartin/credstore.git"

30 },

31 "bugs": {

32 "url": "https://github.com/LocaMartin/credstore/issues"

33 },

34 "scripts": {

35 "dev": "next dev",

36 "build": "next build",

37 "start": "next start",

38 "lint": "next lint",

39 "clean": "rimraf .next out dist",

40 "clean:all": "rimraf .next out dist node_modules",

41 "build:clean": "npm run clean && npm run build",

42 "postinstall": "node scripts/postinstall-desktop.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "test:security": "node scripts/security-smoke-test.mjs",

44 "dist:clean": "npm run clean && npm run dist-linux",

45 "prepack": "npm run export",

46 "export": "next build",

47 "electron": "electron .",

48 "electron-dev": "concurrently \"npm run dev\" \"wait-on http://localhost:3000 && electron .\"",

49 "build-electron": "npm run export && electron-builder",

50 "dist": "npm run export && electron-builder --publish=never",

51 "dist-linux": "npm run export && electron-builder --linux --publish=never",

52 "dist-windows": "npm run export && electron-builder --win --publish=never",

53 "dist-mac": "npm run export && electron-builder --mac --publish=never",

54 "dist-all": "npm run export && electron-builder --linux --win --mac --publish=never",

55 "release": "npm run release:linux && npm run release:windows && npm run release:mac",

56 "release:linux": "npm run export && electron-builder --linux --x64 --arm64 --publish=never",

57 "release:windows": "npm run export && electron-builder --win nsis --x64 --ia32 --publish=never",

58 "release:mac": "npm run export && electron-builder --mac dmg --x64 --arm64 --publish=never",

59 "android:init": "npm run build && npx cap add android",

60 "android:sync": "npm run build && npx cap sync android && node scripts/sync-android-version.js",

61 "android:build": "npm run android:sync && npx cap build android",

62 "android:run": "npm run android:sync && npx cap run android",

scripts/postinstall-desktop.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = credstore@1.0.4 matchedIdentity = npm:Y3JlZHN0b3Jl:1.0.4 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall-desktop.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-desktop.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/postinstall-desktop.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall-desktop.jsView on unpkg

Findings

2 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltascripts/postinstall-desktop.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings