Loading npm security reports…

cs-devtest@1.2.3: Malicious npm security report (Block) | LPM Firewall

registry / cs-devtest / 1.2.3

cs-devtest@1.2.3

Automatic Husky + Gitleaks + SonarQube setup for any JS/TS project

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Installing the package triggers project initialization without an explicit command. The initializer exports the local Git email to a fixed SonarQube service, provisions remote access, and persists its connection configuration in the project.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Unconsented disclosure of Git identity, remote account/password mutation, elevated remote project permissions, and persistence of third-party credentials in the project.

Mechanism

automatic remote SonarQube account provisioning and project configuration injection

Attack narrative

On npm postinstall, bin/index.js enters the consumer project and runs setup. Sonar setup uses a fixed external host by default, reads the local Git email, then creates or changes a remote user and grants broad project permissions. It writes the remote host and login value to sonar-project.properties. These actions occur during installation rather than after an informed user command.

Rationale

This is concrete install-time mutation and data transfer to an external service, not a benign scanner primitive. The fixed remote service, automatic user/password handling, and elevated permission assignment justify blocking publication.

Evidence

package.jsonbin/index.jslib/sonarqube.jslib/gitleaks.jslib/packageManager.jslib/hooks.jslib/ci.js.git/configsonar-project.properties

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/index.js init

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5scripts.postinstall = node ./bin/index.js init Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L5: const execa = require('execa'); L6: const https = require('https'); L7: const { logInfo, logSuccess } = require('./logger'); ... L15: if (process.platform === 'darwin') { L16: return { filename: `gitleaks_${VERSION}_darwin_${arch}.tar.gz`, extract: 'tar', binary: 'gitleaks' }; L17: } ... L20: } L21: return { filename: `gitleaks_${VERSION}_linux_${arch}.tar.gz`, extract: 'tar', binary: 'gitleaks' }; L22: } ... L32: // skip comments and empty lines for duplicate check L33: if (entry.startsWith('#') || entry.trim() === '') { L34: if (!content.includes(entry)) { L36: await fs.copy(CI_SCRIPT_TEMP

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

•scripts.postinstall = node ./bin/index.js init

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/index.jsView file

8// npm does NOT guarantee our own node_modules exists before running postinstall. L9: // We must bootstrap ourselves using only fs, path, child_process (always available). L10: // ─────────────────────────────────────────────────────────────────────────────

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L8

10// ───────────────────────────────────────────────────────────────────────────── L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/index.jsView on unpkg · L10

lib/gitleaks.jsView file

4const path = require('path'); L5: const execa = require('execa'); L6: const https = require('https');

High

Shell

Package source references shell execution.

lib/gitleaks.jsView on unpkg · L4

lib/sonarqube.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cs-devtest@1.1.6 matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.6 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/sonarqube.jsView on unpkg

6const { installDevDependency } = require('./packageManager'); L7: const { execSync } = require('child_process'); L8: L9: const SONAR_PROPS_FILE = 'sonar-project.properties'; L10: const DEFAULT_SONAR_HOST = process.env.SONAR_HOST_URL || 'http://34.100.239.232:9000'; L11: const DEFAULT_SONAR_TOKEN = process.env.SONAR_TOKEN || 'squ_76811d68e795b642385b1de37dc97fb41a13c252';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/sonarqube.jsView on unpkg · L6

lib/husky.jsView file

28try { L29: await execa('npx', ['husky'], opts); // husky v9+ L30: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/husky.jsView on unpkg · L28

templates/github-template/scripts/run-all-scans.shView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/run-all-scans.sh matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/run-all-scans.shView on unpkg

•path = templates/github-template/scripts/run-all-scans.sh kind = build_helper sizeBytes = 25262 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/github-template/scripts/run-all-scans.shView on unpkg

templates/github-template/scripts/generate-html.jsView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/generate-html.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/generate-html.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "cs-devtest",

3 "version": "1.2.3",

4 "description": "Automatic Husky + Gitleaks + SonarQube setup for any JS/TS project",

5 "main": "bin/index.js",

6 "bin": {

7 "cs-devtest": "./bin/index.js"

8 },

9 "keywords": [

10 "husky",

11 "gitleaks",

12 "git-hooks",

13 "security",

14 "sonarqube",

15 "typescript",

16 "eslint"

17 ],

18 "author": "Your Name",

19 "license": "MIT",

20 "scripts": {

21 "postinstall": "node ./bin/index.js init",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepare": "husky || true",

23 "test": "npx --no-install cs-devtest check-hooks 2>/dev/null || true && node --test"

24 },

25 "dependencies": {

26 "@eslint/js": "^8.0.0 || ^9.0.0 || ^10.0.0",

27 "@typescript-eslint/eslint-plugin": ">=5.0.0",

28 "@typescript-eslint/parser": ">=5.0.0",

29 "chalk": "^4.1.2",

30 "dotenv": "^17.3.1",

31 "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",

32 "execa": "^5.1.1",

33 "fs-extra": "^11.3.3",

34 "husky": "^9.0.11",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

35 "newman": "^6.2.1",

36 "newman-reporter-htmlextra": "^1.23.1",

37 "sonarqube-scanner": "^4.0.0"

38 },

39 "peerDependencies": {

40 "@eslint/js": "^8.0.0 || ^9.0.0 || ^10.0.0",

41 "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"

bin/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

3

4// ─────────────────────────────────────────────────────────────────────────────

5// STEP 0 — Self-install own dependencies using ONLY Node.js built-ins.

6//

7// When installed via `npm install /local/path` or `npm install github:user/repo`,

8// npm does NOT guarantee our own node_modules exists before running postinstall.

9// We must bootstrap ourselves using only fs, path, child_process (always available).

10// ─────────────────────────────────────────────────────────────────────────────

lib/gitleaks.jsView file

Lines 1-24javascript

1'use strict';

2

3const fs = require('fs-extra');

4const path = require('path');

5const

lib/sonarqube.jsView file

Lines 1-26javascript

1'use strict';

2

3const fs = require('fs-extra');

4const path = require('path');

5const {

lib/husky.jsView file

Lines 8-45javascript

8

9/**

10 * installHusky(gitRoot)

11 *

12 * gitRoot – directory containing .git

13 * Husky MUST be initialised here so hooks land in gitRoot/.husky/

14 * In a monorepo this differs from process.cwd() (the project root).

15 */

16exports.installHusky = async (

templates/github-template/scripts/run-all-scans.shView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/run-all-scans.sh matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/run-all-scans.shView on unpkg

•path = templates/github-template/scripts/run-all-scans.sh kind = build_helper sizeBytes = 25262 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/github-template/scripts/run-all-scans.shView on unpkg

templates/github-template/scripts/generate-html.jsView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/generate-html.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/generate-html.jsView on unpkg