registry / Install hook abuse / electron-orbit / 1.1.2

electron-orbit@1.1.2

Electron-style runtime discovery and launch planning toolkit with optional native bootstrap installation.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The postinstall hook automatically collects host and user identifiers into local artifacts and attempts an out-of-package marker write, which warrants a warning. The inspected source does not establish an external transfer or another basis for blocking publication.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its postinstall script.

Impact

Host identifiers are retained locally, and installation may create or overwrite a marker outside the package directory.

Mechanism

The installer writes host details to a generated bootstrap artifact and install log, then attempts to write a marker in the current working directory or system temporary directory.

AI rationale

Evidence

package.jsoninstall.jsbin/formatters/formatter-general-*bin/formatters/install-log.jsonelectron_orbit_install_marker.txt

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The postinstall script automatically runs install.js.
The installer includes the machine hostname in its generated local bootstrap artifact.
The installer records the hostname and username in its install log.
The install log is written to disk during installation.
The installer attempts to write a marker in the working directory or system temporary directory.
The runtime returns a launch plan using process.execPath; inspected source does not establish an external transfer.

Evidence against

The inspected installer and runtime source show local file writes and launch-plan construction, but no network send.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystem

Supply chain

Minified

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 21.5 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 32-73json

32 "types": "./dist/index.d.ts",

33 "default": "./dist/index.js"

34 }

35 },

36 "bin": {

37 "electron-orbit": "bin/cli.js"

38 },

39 "files": [

40 "dist",

41 "src",

42 "bin/cli.js",

43 "index.js",

44 "index.d.ts",

45 "install.js",

46 "README.md",

47 "LICENSE"

48 ],

49 "engines": {

50 "node": ">=14.0.0"

51 },

52 "scripts": {

53 "postinstall": "node install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "build": "tsc && esbuild src/index.ts --bundle --outfile=dist/index.js --platform=node && esbuild src/index.ts --bundle --outfile=dist/index.mjs --format=esm --platform=node",

Medium

Suspicious Lifecycle Evidence

The postinstall script automatically runs install.js.

package.jsonView on unpkg · L52

55 "build:prod": "tsc && esbuild src/index.ts --bundle --outfile=dist/index.js --minify --platform=node",

56 "compile": "tsc",

57 "watch": "tsc --watch",

58 "lint": "eslint src --ext ts"

59 },

60 "devDependencies": {

61 "@eslint/js": "^10.0.1",

62 "@types/node": "^20.0.0",

63 "@typescript-eslint/eslint-plugin": "^8.0.0",

64 "@typescript-eslint/parser": "^8.0.0",

65 "esbuild": "^0.28.0",

66 "eslint": "^8.57.1",

67 "eslint-plugin-react": "^7.37.5",

68 "globals": "^17.13.0",

69 "typescript": "^5.3.3",

70 "typescript-eslint": "^8.71.2"

71 },

72 "allowScripts": {

73 "esbuild@0.28.2": true

install.jsView file

Lines 58-98javascript

58 return `formatter-general-${this.platform.arch}${this.getArtifactExtension()}`;

59 }

61 getArtifactPath() {

62 return path.

src/index.tsView file

Lines 136-169typescript

136 }

137

138 const env: Record<string, string> = {

139 ...Object.keys(process.env).reduce<Record<string

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

52"scripts": { "postinstall": "node install.js", "build": "tsc && esbuild src/index.t

Medium

Suspicious Lifecycle Evidence

The postinstall script automatically runs install.js.

package.jsonView on unpkg · L52

install.jsView file

Findings

1 High8 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidenceinstall.js

MediumAi Review Evidencesrc/index.ts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to electron-orbit@1.1.2.

See all versions of electron-orbit for other recorded verdicts.

Review the evidence and your use of electron-orbit@1.1.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 12:42:05.362Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.