registry / evilpostinstall / 0.4.0

evilpostinstall@0.4.0

⚠ Under review

Assess the system running postinstall

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 6 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 480 B of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-24json

2 "name": "evilpostinstall",

3 "version": "0.4.0",

4 "description": "Assess the system running postinstall",

5 "main": "index.js",

6 "scripts": {

7 "test": "echo \"Error: no test specified\" && exit 1",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L8

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 },

10 "author": "",

11 "license": "BSD-2-Clause",

12 "backstage": {

13 "role": "frontend-plugin",

14 "pluginId": "example"

15 },

16 "exports": {

17 ".": {

18 "backstage": "./src/plugin.ts"

19 },

20 "./package.json": "./package.json"

21 }

23}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

evilpostinstall-192.168.1.100.tgzView file

•path = evilpostinstall-192.168.1.100.tgz kind = compressed_blob sizeBytes = 1017 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

evilpostinstall-192.168.1.100.tgzView on unpkg

•path = evilpostinstall-192.168.1.100.tgz kind = nested_archive_needs_inspection sizeBytes = 1017 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

evilpostinstall-192.168.1.100.tgzView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

evilpostinstall-192.168.1.100.tgzView file

•path = evilpostinstall-192.168.1.100.tgz kind = compressed_blob sizeBytes = 1017 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

evilpostinstall-192.168.1.100.tgzView on unpkg

•path = evilpostinstall-192.168.1.100.tgz kind = nested_archive_needs_inspection sizeBytes = 1017 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

evilpostinstall-192.168.1.100.tgzView on unpkg

Findings

1 Critical2 High1 Medium2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedpackage.json

MediumShips Compressed Blobevilpostinstall-192.168.1.100.tgz

LowScripts Present

LowNested Archive Needs Inspectionevilpostinstall-192.168.1.100.tgz