registry / Install hook abuse / insomnia-plugin-poc-m4gester-run
insomnia-plugin-poc-m4gester-run
This report shows the evidence for insomnia-plugin-poc-m4gester-run@1.0.0, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect source inspection confirms the only substantive behavior is an automatic postinstall command with no legitimate package purpose. Although there is no exfiltration or persistence, unconsented lifecycle command execution is concrete install-hook abuse.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall lifecycle
Impact
Executes calc.exe on Windows during install; demonstrates arbitrary lifecycle command execution without package-aligned purpose.
Mechanism
unconsented install-time external command execution
Attack narrative
Installing the package triggers npm's postinstall lifecycle and executes calc.exe on Windows. The main Insomnia plugin entrypoint does nothing, so the meaningful behavior is the unconsented install-time command rather than runtime plugin functionality.
AI rationale
Direct source inspection confirms the only substantive behavior is an automatic postinstall command with no legitimate package purpose. Although there is no exfiltration or persistence, unconsented lifecycle command execution is concrete install-hook abuse.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines postinstall lifecycle script: calc.exe.
- The lifecycle command runs automatically during npm install on Windows.
- Package contains no legitimate install/build logic to justify install-time command execution.
Evidence against
- index.js only exports an empty Insomnia requestHooks array.
- No network endpoints, credential harvesting, file traversal, AI-agent control-surface writes, or persistence beyond lifecycle execution were found.
Behavioral surface
Trivial
NoLicense
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = calc.exe
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = calc.exe
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to insomnia-plugin-poc-m4gester-run@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing insomnia-plugin-poc-m4gester-run@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.