Loading npm security reports…

cs-devtest@1.1.17: Malicious npm security report (Block) | LPM Firewall

registry / cs-devtest / 1.1.17

cs-devtest@1.1.17

Automatic Husky + Gitleaks + SonarQube setup for any JS/TS project

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On npm postinstall, the package changes the consumer project and provisions an external SonarQube account using the developer's Git email. It also installs hooks and writes scanner credentials.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation of cs-devtest@1.1.17

Impact

Unconsented Git-email disclosure, external admin-account changes, credentialed project configuration, and persistent hook/CI modification.

Mechanism

postinstall project mutation plus remote account provisioning

Attack narrative

Installing the package invokes init automatically in the consumer project. That setup reads the local Git email, uses embedded Sonar defaults to create or modify a remote user and assign project admin permission, then writes the Sonar login into project configuration. It additionally overwrites Git hooks and CI assets, creating persistent execution in the consumer repository.

Rationale

The lifecycle behavior performs unconsented external account administration and project mutation, not merely local security-tool setup. The hardcoded credential path and Git-email transmission establish a concrete malicious chain.

Evidence

package.jsonbin/index.jslib/sonarqube.jslib/hooks.jslib/gitleaks.jslib/ci.js.husky/pre-commit.husky/pre-pushsonar-project.properties.gitleaksignore.tools/gitleaks/gitleaks

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/index.js init

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5scripts.postinstall = node ./bin/index.js init Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L5: const execa = require('execa'); L6: const https = require('https'); L7: const { logInfo, logSuccess } = require('./logger'); ... L15: if (process.platform === 'darwin') { L16: return { filename: `gitleaks_${VERSION}_darwin_${arch}.tar.gz`, extract: 'tar', binary: 'gitleaks' }; L17: } ... L20: } L21: return { filename: `gitleaks_${VERSION}_linux_${arch}.tar.gz`, extract: 'tar', binary: 'gitleaks' }; L22: } ... L32: // skip comments and empty lines for duplicate check L33: if (entry.startsWith('#') || entry.trim() === '') { L34: if (!content.includes(entry)) { L36: await fs.copy(CI_SCRIPT_TEMP

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

•scripts.postinstall = node ./bin/index.js init

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/index.jsView file

8// npm does NOT guarantee our own node_modules exists before running postinstall. L9: // We must bootstrap ourselves using only fs, path, child_process (always available). L10: // ─────────────────────────────────────────────────────────────────────────────

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.11 matchedPath = bin/index.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg

10// ───────────────────────────────────────────────────────────────────────────── L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/index.jsView on unpkg · L10

lib/gitleaks.jsView file

4const path = require('path'); L5: const execa = require('execa'); L6: const https = require('https');

High

Shell

Package source references shell execution.

lib/gitleaks.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.11 matchedPath = lib/gitleaks.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/gitleaks.jsView on unpkg

lib/sonarqube.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cs-devtest@1.1.6 matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.6 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/sonarqube.jsView on unpkg

6const { installDevDependency } = require('./packageManager'); L7: const { execSync } = require('child_process'); L8: L9: const SONAR_PROPS_FILE = 'sonar-project.properties'; L10: const DEFAULT_SONAR_HOST = process.env.SONAR_HOST_URL || 'http://34.100.239.232:9000'; L11: const DEFAULT_SONAR_TOKEN = process.env.SONAR_TOKEN || 'squ_76811d68e795b642385b1de37dc97fb41a13c252';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/sonarqube.jsView on unpkg · L6

lib/husky.jsView file

28try { L29: await execa('npx', ['husky'], opts); // husky v9+ L30: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/husky.jsView on unpkg · L28

templates/github-template/scripts/run-all-scans.shView file

•path = templates/github-template/scripts/run-all-scans.sh kind = build_helper sizeBytes = 25265 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/github-template/scripts/run-all-scans.shView on unpkg

templates/github-template/scripts/generate-html.jsView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.11 matchedPath = templates/github-template/scripts/generate-html.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/generate-html.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "cs-devtest",

3 "version": "1.1.17",

4 "description": "Automatic Husky + Gitleaks + SonarQube setup for any JS/TS project",

5 "main": "bin/index.js",

6 "bin": {

7 "cs-devtest": "./bin/index.js"

8 },

9 "keywords": [

10 "husky",

11 "gitleaks",

12 "git-hooks",

13 "security",

14 "sonarqube",

15 "typescript",

16 "eslint"

17 ],

18 "author": "Your Name",

19 "license": "MIT",

20 "scripts": {

21 "postinstall": "node ./bin/index.js init",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepare": "husky || true",

23 "test": "npx --no-install cs-devtest check-hooks 2>/dev/null || true && node --test"

24 },

25 "dependencies": {

26 "@eslint/js": "^8.0.0 || ^9.0.0 || ^10.0.0",

27 "@typescript-eslint/eslint-plugin": ">=5.0.0",

28 "@typescript-eslint/parser": ">=5.0.0",

29 "chalk": "^4.1.2",

30 "dotenv": "^17.3.1",

31 "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",

32 "execa": "^5.1.1",

33 "fs-extra": "^11.3.3",

34 "husky": "^9.0.11",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

35 "newman": "^6.2.1",

36 "newman-reporter-htmlextra": "^1.23.1",

37 "sonarqube-scanner": "^4.0.0"

38 },

39 "peerDependencies": {

40 "@eslint/js": "^8.0.0 || ^9.0.0 || ^10.0.0",

41 "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"

bin/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

3

4// ─────────────────────────────────────────────────────────────────────────────

5// STEP 0 — Self-install own dependencies using ONLY Node.js built-ins.

6//

7// When installed via `npm install /local/path` or `npm install github:user/repo`,

8// npm does NOT guarantee our own node_modules exists before running postinstall.

9// We must bootstrap ourselves using only fs, path, child_process (always available).

10// ─────────────────────────────────────────────────────────────────────────────

lib/gitleaks.jsView file

Lines 1-24javascript

1'use strict';

2

3const fs = require('fs-extra');

4const path = require('path');

5const

lib/sonarqube.jsView file

Lines 1-26javascript

1'use strict';

2

3const fs = require('fs-extra');

4const path = require('path');

5const {

lib/husky.jsView file

Lines 8-45javascript

8

9/**

10 * installHusky(gitRoot)

11 *

12 * gitRoot – directory containing .git

13 * Husky MUST be initialised here so hooks land in gitRoot/.husky/

14 * In a monorepo this differs from process.cwd() (the project root).

15 */

16exports.installHusky = async (

templates/github-template/scripts/run-all-scans.shView file

•path = templates/github-template/scripts/run-all-scans.sh kind = build_helper sizeBytes = 25265 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/github-template/scripts/run-all-scans.shView on unpkg

templates/github-template/scripts/generate-html.jsView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.11 matchedPath = templates/github-template/scripts/generate-html.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/generate-html.jsView on unpkg