Loading npm security reports…

demovid: Malicious npm security report (Block) | LPM Firewall

registry / demovid / 0.5.0

demovid@0.5.0

Rode dentro do seu projeto frontend, descreva a demo em português, e receba um MP4 narrado + uma timeline com os tempos de cada fala e os melhores pontos de corte. O roteiro é escrito por IA a partir dos elementos reais do app.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installation downloads a mutable remote shell script and executes it with bash. This is automatic for npm installs on Linux/macOS unless the user sets an opt-out variable.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install, including npx installation, without DEMOVID_SKIP_PLANNOTATOR set

Impact

The remote host can run arbitrary commands as the installing user and install or alter software.

Mechanism

remote script download, temporary-file staging, and bash execution

Attack narrative

The postinstall hook fetches a live installer from plannotator.ai, stores it in a temporary install.sh, then launches bash with that file. The response is neither pinned nor integrity-checked, so a compromised endpoint or changed installer gains code execution during dependency installation. The package comments acknowledge the upstream installer can modify AI-agent configuration in its default mode, but this package cannot verify the claimed --minimal behavior.

Rationale

Automatic execution of an unverified, remotely supplied shell payload is a concrete install-time remote-code-execution chain. Runtime API and media-tool execution do not mitigate that install-time behavior.

Evidence

package.jsonscripts/postinstall.mjs

Network endpoints1

plannotator.ai/install.sh

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/exec.jsView file

13*/ L14: import { execFile } from "node:child_process"; L15: import { access, constants } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/exec.jsView on unpkg · L13

30* L31: * Deliberately NOT `sh -c "command -v"`: that would be a shell, which this L32: * project forbids, and `command` is a shell builtin that cannot be exec'd

High

Shell

Package source references shell execution.

dist/exec.jsView on unpkg · L30

scripts/postinstall.mjsView file

26*/ L27: import { spawn } from "node:child_process"; L28: import { access, constants, mkdtemp, rm, writeFile } from "node:fs/promises"; ... L31: L32: const INSTALLER_URL = "https://plannotator.ai/install.sh"; L33: const DOWNLOAD_TIMEOUT_MS = 20_000; ... L39: async function onPath(bin) { L40: for (const dir of (process.env.PATH ?? "").split(":")) { L41: if (!dir) continue;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/postinstall.mjsView on unpkg · L26

26*/ L27: import { spawn } from "node:child_process"; L28: import { access, constants, mkdtemp, rm, writeFile } from "node:fs/promises"; ... L31: L32: const INSTALLER_URL = "https://plannotator.ai/install.sh"; L33: const DOWNLOAD_TIMEOUT_MS = 20_000; ... L35: L36: const note = (line) => process.stderr.write(`[demovid] ${line}\n`); L37: ... L39: async function onPath(bin) { L40: for (const dir of (process.env.PATH ?? "").split(":")) { L41: if (!dir) continue;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.mjsView on unpkg · L26

26*/ L27: import { spawn } from "node:child_process"; L28: import { access, constants, mkdtemp, rm, writeFile } from "node:fs/promises"; ... L31: L32: const INSTALLER_URL = "https://plannotator.ai/install.sh"; L33: const DOWNLOAD_TIMEOUT_MS = 20_000; ... L35: L36: const note = (line) => process.stderr.write(`[demovid] ${line}\n`); L37: ... L39: async function onPath(bin) { L40: for (const dir of (process.env.PATH ?? "").split(":")) { L41: if (!dir) continue;

Source & flagged code

8 flagged

package.jsonView file

Lines 11-51json

11 "exports": {

12 ".": {

13 "types": "./dist/index.d.ts",

14 "default": "./dist/index.js"

15 },

16 "./package.json": "./package.json"

17 },

18 "files": [

19 "dist",

20 "templates",

21 "scripts/postinstall.mjs",

22 "README.md",

23 "LICENSE",

24 "NOTICE"

25 ],

26 "engines": {

27 "node": ">=20"

28 },

29 "scripts": {

30 "prepare": "npm run bake:springs && npm run build",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepublishOnly": "npm run typecheck && npm test",

33 "build": "npm run build:overlay && tsc -p tsconfig.build.json",

34 "build:overlay": "node --import tsx scripts/build-overlay.ts",

35 "bake:springs": "node --import tsx scripts/bake-springs.ts",

36 "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",

37 "dev": "tsx src/index.ts",

38 "start": "node dist/index.js",

39 "typecheck": "tsc -p tsconfig.json --noEmit",

40 "test": "node --import tsx --test test/*.test.ts",

41 "link": "npm run build && npm link && demovid --help",

42 "test:e2e": "node test/stage.e2e.mjs",

43 "test:gif": "node --import tsx test/gif.e2e.ts",

44 "test:remotion": "node --import tsx test/remotion.e2e.ts",

45 "verify": "npm run typecheck && npm run bake:springs && npm run build && npm test && npm run test:gif && npm run test:e2e && npm run test:record",

46 "test:record": "node --import tsx test/record.e2e.ts",

47 "verify:pack": "npm pack --dry-run"

48 },

49 "publishConfig": {

50 "access": "public"

51 },

dist/exec.jsView file

Lines 1-50javascript

1/**

2 * One typed wrapper around `execFile` for every external binary

3 * (rec / ffmpeg / ffprobe / xdotool). Array args, NO shell — so untrusted file

4 * paths can never be interpreted as shell metacharacters. Maps the two failure

5 * modes callers care about: a missing binary (`ENOENT`) vs a non-zero exit.

6 *

7 * Adapted from trackscribe/src/exec.ts, same contract.

8 *

9 * Consequence of "no shell": no pipes, no redirects. Use tool flags instead

10 * (ffmpeg `-f null -`, rec `--dry-run`). For long-running children that must be

scripts/postinstall.mjsView file

Lines 6-46javascript

6 * installer — so it cannot be an npm dependency, optional or otherwise. This is

7 * the closest honest equivalent: run the official installer, in the one mode

8 * that installs nothing but the binary.

9 *

10 * ## Rules this script obeys, all of them load