Loading npm security reports…

nginxforge-panel@1.1.5: Malicious npm security report (Block) | LPM Firewall

registry / nginxforge-panel / 1.1.5

nginxforge-panel@1.1.5

Modern VPS Hosting Control Panel with Automated Nginx, Zero-Downtime Deployments, Let's Encrypt TLS, Multi-Tenant Database Management, and AI Copilot.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package in an interactive terminal launches a host-system installer automatically. It can install operating-system packages with sudo and enable services.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation with lifecycle scripts enabled in an interactive terminal

Impact

The installation can modify the host package set and start Nginx, MariaDB, or PostgreSQL services without an explicit setup command.

Mechanism

postinstall-driven system package installation and service activation

Attack narrative

The package declares a postinstall hook that automatically starts its system installer when npm is run in an interactive terminal. That installer treats missing host tools as selected by default, invokes the operating-system package manager as root or through sudo, and enables services. This is a broad host mutation initiated by package installation rather than an explicit administrator setup command.

Rationale

The automatic lifecycle hook performs privileged host configuration and service activation. This is concrete install-hook abuse, despite CI and non-interactive guards.

Evidence

package.jsonscripts/postinstall.mjsscripts/system-installer.mjs

Decision evidence

public snapshot

AI called this at 96.0% confidence with false-positive risk.

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nginxforge.mjsView file

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16:

High

Child Process

Package source references child process execution.

bin/nginxforge.mjsView on unpkg · L14

84} else { L85: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable nginxforge.service"`, { stdio: "ignore" }); L86: }

High

Shell

Package source references shell execution.

bin/nginxforge.mjsView on unpkg · L84

14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit", ... L160: console.log(` ${token}`);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/nginxforge.mjsView on unpkg · L14

14Detached bundled service listener: bin/nginxforge.mjs spawns dist/index.js; helper exposes a broad-bound HTTP listener. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit", ... L160: console.log(` ${token}`);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/nginxforge.mjsView on unpkg · L14

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit", ... L160: console.log(` ${token}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/nginxforge.mjsView on unpkg · L14

dist/index.jsView file

40L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json L42: var require_package = __commonJS({ ... L76: }, L77: homepage: "https://github.com/motdotla/dotenv#readme", L78: funding: "https://dotenvx.com", ... L145: function supportsAnsi() { L146: return process.stdout.isTTY; L147: } ... L176: if (!result.parsed) { L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L178: err.code = "MISSING_DATA";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L40

40Trigger-reachable chain: scripts.start -> dist/index.js L40: L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json L42: var require_package = __commonJS({ ... L76: }, L77: homepage: "https://github.com/motdotla/dotenv#readme", L78: funding: "https://dotenvx.com", ... L145: function supportsAnsi() { L146: return process.stdout.isTTY; L147: } ... L176: if (!result.parsed) { L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L178: err.code = "MISSING_DATA";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L40

•matchType = previous_version_dangerous_delta matchedPackage = nginxforge-panel@1.0.4 matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.4 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/system-installer.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = scripts/system-installer.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/system-installer.mjsView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.807 matchedPath = web-dist/assets/cytoscape.esm-DTSO7Bv0.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView on unpkg

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

Lines 26-66json

26 "server",

27 "client",

28 "bin",

29 "scripts",

30 "agent",

31 "shared",

32 "pgadmin-ui",

33 "install.sh",

34 "drizzle.config.ts",

35 "vite.config.ts",

36 "tsconfig.json",

37 "package.json",

38 "README.md",

39 "LICENSE"

40 ],

41 "scripts": {

42 "dev": "NODE_ENV=development tsx watch server/_core/index.ts",

43 "build": "vite build && esbuild server/_core/index.ts --platform=node --bundle --format=esm --outdir=dist --external:better-sqlite3 --external:@node-rs/argon2 --external:mysql2 \"--banner:js=import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);\"",

44 "start": "NODE_ENV=production node dist/index.js",

45 "setup": "node scripts/system-installer.mjs",

46 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "prepublishOnly": "pnpm build && pnpm release-check",

48 "check": "tsc --noEmit",

49 "format": "prettier --write .",

50 "test": "vitest run",

51 "release-check": "node scripts/release-check.mjs",

52 "db:push": "drizzle-kit generate && drizzle-kit migrate"

53 },

54 "dependencies": {

55 "@aws-sdk/client-s3": "^3.693.0",

56 "@aws-sdk/s3-request-presigner": "^3.693.0",

57 "@hookform/resolvers": "^5.2.2",

58 "@monaco-editor/react": "^4.7.0",

59 "@node-rs/argon2": "^2.1.0",

60 "@radix-ui/react-accordion": "^1.2.12",

61 "@radix-ui/react-alert-dialog": "^1.1.15",

62 "@radix-ui/react-aspect-ratio": "^1.1.7",

63 "@radix-ui/react-avatar": "^1.1.10",

64 "@radix-ui/react-checkbox": "^1.3.3",

65 "@radix-ui/react-collapsible": "^1.1.12",

66 "@radix-ui/react-context-menu": "^2.2.16",

bin/nginxforge.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * NginxForge CLI Entrypoint

4 * Supports:

5 * nginxforge setup - Interactively detect and install required system tools & runtimes

6 * nginxforge check - Run production health checks

7 * nginxforge start - Start the NginxForge production control plane

8 */

9

10import path from "node:path"

dist/index.jsView file

40L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json L42: var require_package = __commonJS({ ... L76: }, L77: homepage: "https://github.com/motdotla/dotenv#readme", L78: funding: "https://dotenvx.com", ... L145: function supportsAnsi() { L146: return process.stdout.isTTY; L147: } ... L176: if (!result.parsed) { L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L178: err.code = "MISSING_DATA";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L40

40Trigger-reachable chain: scripts.start -> dist/index.js L40: L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json L42: var require_package = __commonJS({ ... L76: }, L77: homepage: "https://github.com/motdotla/dotenv#readme", L78: funding: "https://dotenvx.com", ... L145: function supportsAnsi() { L146: return process.stdout.isTTY; L147: } ... L176: if (!result.parsed) { L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L178: err.code = "MISSING_DATA";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L40

•matchType = previous_version_dangerous_delta matchedPackage = nginxforge-panel@1.0.4 matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.4 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/system-installer.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = scripts/system-installer.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/system-installer.mjsView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.807 matchedPath = web-dist/assets/cytoscape.esm-DTSO7Bv0.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.807 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView on unpkg

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.0 matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView on unpkg