registry / Remote code execution / demovid
demovid
Rode dentro do seu projeto frontend, descreva a demo em português, e receba um MP4 narrado + uma timeline com os tempos de cada fala e os melhores pontos de corte. O roteiro é escrito por IA a partir dos elementos reais do app.
This report shows the evidence for demovid@0.5.0. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiAutomatic execution of an unverified, remotely supplied shell payload is a concrete install-time remote-code-execution chain. Runtime API and media-tool execution do not mitigate that install-time behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install, including npx installation, without DEMOVID_SKIP_PLANNOTATOR set
Impact
The remote host can run arbitrary commands as the installing user and install or alter software.
Mechanism
remote script download, temporary-file staging, and bash execution
Attack narrative
The postinstall hook fetches a live installer from plannotator.ai, stores it in a temporary install.sh, then launches bash with that file. The response is neither pinned nor integrity-checked, so a compromised endpoint or changed installer gains code execution during dependency installation. The package comments acknowledge the upstream installer can modify AI-agent configuration in its default mode, but this package cannot verify the claimed --minimal behavior.
AI rationale
Automatic execution of an unverified, remotely supplied shell payload is a concrete install-time remote-code-execution chain. Runtime API and media-tool execution do not mitigate that install-time behavior.
Evidence
package.jsonscripts/postinstall.mjs
Network endpoints1
plannotator.ai/install.sh
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs postinstall automatically.
- scripts/postinstall.mjs fetches https://plannotator.ai/install.sh.
- It writes the unverified response to a temp install.sh and spawns bash on it.
- The install is enabled by default; DEMOVID_SKIP_PLANNOTATOR is only an opt-out.
- No hash, signature, or pinned artifact verification protects the downloaded script.
Evidence against
- Other network calls in dist/openai/* are runtime OpenAI API features using OPENAI_API_KEY.
- dist/exec.js uses execFile with argument arrays rather than a shell.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/exec.jsView file
13*/
L14: import { execFile } from "node:child_process";
L15: import { access, constants } from "node:fs/promises";
High
30*
L31: * Deliberately NOT `sh -c "command -v"`: that would be a shell, which this
L32: * project forbids, and `command` is a shell builtin that cannot be exec'd
Findings
7 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/exec.js
HighShelldist/exec.js
HighSame File Env Network Executionscripts/postinstall.mjs
HighSandbox Evasion Gated Capabilityscripts/postinstall.mjs
HighInstall Named Payload Filescripts/postinstall.mjs
HighPrevious Version Dangerous Deltascripts/postinstall.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to demovid@0.5.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing demovid@0.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.