Loading npm security reports…

cs-devtest@1.2.7: Malicious npm security report (Block) | LPM Firewall

registry / cs-devtest / 1.2.7

cs-devtest@1.2.7

Automatic Husky + Gitleaks + SonarQube setup for any JS/TS project

AI Security Review

scanned 9h ago · by lpm-firewall-ai

On npm postinstall, the package modifies the installing project and contacts a fixed SonarQube server. It extracts the local Git email, creates or changes a remote account, and grants it administrative project permissions.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall of cs-devtest@1.2.7

Impact

Unconsented disclosure of Git identity to a fixed host, remote account/password mutation, administrative access assignment, and persistent project hook/config changes.

Mechanism

automatic project mutation plus remote SonarQube account provisioning and permission escalation

Attack narrative

Installing the package runs its initializer without an explicit command. The initializer reads the repository Git email, sends it to a hard-coded HTTP SonarQube host, creates or updates an account, and assigns administrative project permissions. It also persists hooks/configuration in the host project and downloads an executable scanner archive without a checksum.

Rationale

The postinstall chain performs unconsented remote identity/account administration against a fixed external host using embedded default credentials, not merely local development-tool setup. This is concrete malicious install-time behavior.

Evidence

package.jsonbin/index.jslib/sonarqube.jslib/gitleaks.jslib/hooks.jslib/ci.js.husky/pre-commit.husky/pre-push.gitignore.gitleaksignore

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/index.js init

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5scripts.postinstall = node ./bin/index.js init Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L5: const execa = require('execa'); L6: const https = require('https'); L7: const { logInfo, logSuccess } = require('./logger'); ... L15: if (process.platform === 'darwin') { L16: return { filename: `gitleaks_${VERSION}_darwin_${arch}.tar.gz`, extract: 'tar', binary: 'gitleaks' }; L17: } ... L20: } L21: return { filename: `gitleaks_${VERSION}_linux_${arch}.tar.gz`, extract: 'tar', binary: 'gitleaks' }; L22: } ... L32: // skip comments and empty lines for duplicate check L33: if (entry.startsWith('#') || entry.trim() === '') { L34: if (!content.includes(entry)) { L36: await fs.copy(CI_SCRIPT_TEMP

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

•scripts.postinstall = node ./bin/index.js init

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/index.jsView file

8// npm does NOT guarantee our own node_modules exists before running postinstall. L9: // We must bootstrap ourselves using only fs, path, child_process (always available). L10: // ─────────────────────────────────────────────────────────────────────────────

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L8

10// ───────────────────────────────────────────────────────────────────────────── L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/index.jsView on unpkg · L10

lib/gitleaks.jsView file

4const path = require('path'); L5: const execa = require('execa'); L6: const https = require('https');

High

Shell

Package source references shell execution.

lib/gitleaks.jsView on unpkg · L4

lib/sonarqube.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cs-devtest@1.1.6 matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.6 similarity = 0.429 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/sonarqube.jsView on unpkg

6const { installDevDependency } = require('./packageManager'); L7: const { execSync } = require('child_process'); L8: L9: const SONAR_PROPS_FILE = 'sonar-project.properties'; L10: const DEFAULT_SONAR_HOST = process.env.SONAR_HOST_URL || 'http://34.100.239.232:9000'; L11: const DEFAULT_SONAR_TOKEN = process.env.SONAR_TOKEN || 'squ_76811d68e795b642385b1de37dc97fb41a13c252';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/sonarqube.jsView on unpkg · L6

lib/husky.jsView file

28try { L29: await execa('npx', ['husky'], opts); // husky v9+ L30: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/husky.jsView on unpkg · L28

templates/github-template/scripts/run-all-scans.shView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/run-all-scans.sh matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/run-all-scans.shView on unpkg

•path = templates/github-template/scripts/run-all-scans.sh kind = build_helper sizeBytes = 25262 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/github-template/scripts/run-all-scans.shView on unpkg

templates/github-template/scripts/generate-html.jsView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/generate-html.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/generate-html.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "cs-devtest",

3 "version": "1.2.7",

4 "description": "Automatic Husky + Gitleaks + SonarQube setup for any JS/TS project",

5 "main": "bin/index.js",

6 "bin": {

7 "cs-devtest": "./bin/index.js"

8 },

9 "keywords": [

10 "husky",

11 "gitleaks",

12 "git-hooks",

13 "security",

14 "sonarqube",

15 "typescript",

16 "eslint"

17 ],

18 "author": "Your Name",

19 "license": "MIT",

20 "scripts": {

21 "postinstall": "node ./bin/index.js init",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "prepare": "husky || true",

23 "test": "npx --no-install cs-devtest check-hooks 2>/dev/null || true && node --test"

24 },

25 "dependencies": {

26 "@eslint/js": "^8.0.0 || ^9.0.0 || ^10.0.0",

27 "@typescript-eslint/eslint-plugin": ">=5.0.0",

28 "@typescript-eslint/parser": ">=5.0.0",

29 "chalk": "^4.1.2",

30 "dotenv": "^17.3.1",

31 "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0",

32 "execa": "^5.1.1",

33 "fs-extra": "^11.3.3",

34 "husky": "^9.0.11",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L5

35 "newman": "^6.2.1",

36 "newman-reporter-htmlextra": "^1.23.1",

37 "sonarqube-scanner": "^4.0.0"

38 },

39 "peerDependencies": {

40 "@eslint/js": "^8.0.0 || ^9.0.0 || ^10.0.0",

41 "eslint": "^8.0.0 || ^9.0.0 || ^10.0.0"

bin/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

3

4// ─────────────────────────────────────────────────────────────────────────────

5// STEP 0 — Self-install own dependencies using ONLY Node.js built-ins.

6//

7// When installed via `npm install /local/path` or `npm install github:user/repo`,

8// npm does NOT guarantee our own node_modules exists before running postinstall.

9// We must bootstrap ourselves using only fs, path, child_process (always available).

10// ─────────────────────────────────────────────────────────────────────────────

lib/gitleaks.jsView file

Lines 1-24javascript

1'use strict';

2

3const fs = require('fs-extra');

4const path = require('path');

5const

lib/sonarqube.jsView file

Lines 1-26javascript

1'use strict';

2

3const fs = require('fs-extra');

4const path = require('path');

5const {

lib/husky.jsView file

Lines 8-45javascript

8

9/**

10 * installHusky(gitRoot)

11 *

12 * gitRoot – directory containing .git

13 * Husky MUST be initialised here so hooks land in gitRoot/.husky/

14 * In a monorepo this differs from process.cwd() (the project root).

15 */

16exports.installHusky = async (

templates/github-template/scripts/run-all-scans.shView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/run-all-scans.sh matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/run-all-scans.shView on unpkg

•path = templates/github-template/scripts/run-all-scans.sh kind = build_helper sizeBytes = 25262 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/github-template/scripts/run-all-scans.shView on unpkg

templates/github-template/scripts/generate-html.jsView file

•matchType = normalized_sha256 matchedPackage = cs-devtest@1.1.15 matchedPath = templates/github-template/scripts/generate-html.js matchedIdentity = npm:Y3MtZGV2dGVzdA:1.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/github-template/scripts/generate-html.jsView on unpkg