registry / malware-catnip / 1.0.2

malware-catnip@1.0.2

Benign, educational install-hook demonstrator for testing software supply-chain dependency/install-script detection. Not malware.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installation automatically starts detached code that opens up to six browser windows playing a bundled video. This creates an unsolicited disruptive effect on the installing user's desktop.

Static reason

One or more suspicious static signals were detected.

Trigger

The package's preinstall lifecycle hook runs during installation.

Impact

Unexpected windows interrupt the user and create files within the package directory.

Mechanism

The hook relaunches itself detached, writes an autoplay page in the package assets directory, then starts staggered browser windows with separate profile directories.

Attack narrative

The install hook continues in a detached process and launches multiple browser windows without an installation-time user choice. The README describes the package as a security testing sample, but package-authored claims do not establish benign intent.

AI rationale

The automatic lifecycle hook launches six unsolicited browser windows and detaches its process, creating disruptive behavior on installation. The README's self-description as a benign scanner fixture does not excuse that behavior.

Evidence

package.jsonpreinstall.jsassets/video.mp4assets/_app.htmlassets/_p0assets/_p1assets/_p2assets/_p3assets/_p4assets/_p5

malware-catnip@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code