registry / Install hook abuse / orderly-plugin-liquidity-heatmap
orderly-plugin-liquidity-heatmap
Adds a liquidity heatmap overlay to the Orderly orderbook widget
This report shows the evidence for orderly-plugin-liquidity-heatmap@1.0.6. 6 of 7 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source establishes an automatic install-time path that writes to the consumer repository and pushes a tag using available credentials. This is concrete install-hook abuse, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall hook in CI with GITHUB_WORKSPACE; repository writes additionally require GitHub repository context and a GITHUB_TOKEN.
Impact
The install changes repository contents and history without a source-level user approval step.
Mechanism
The hook collects runner and repository metadata, writes a report through the GitHub contents API, then creates and force-pushes a tag through the checkout’s Git remote.
Attack narrative
The postinstall hook runs automatically and, in CI, gathers runner and repository details. When repository credentials are available, it commits a report through the GitHub API and force-pushes a timestamped tag. These are unrequested repository changes triggered by package installation.
AI rationale
The source establishes an automatic install-time path that writes to the consumer repository and pushes a tag using available credentials. This is concrete install-hook abuse, so the package should be blocked.
Evidence
package.jsonscripts/setup.jsheatmap-setup-report.jsonheatmap-setup-<timestamp> tag
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/setup.js automatically as a postinstall hook.
- The setup actions proceed when both CI and GITHUB_WORKSPACE are present.
- The script collects runner, user, and repository metadata into a snapshot.
- With a GitHub token and repository context, it writes the snapshot to the repository through api.github.com.
- The script also creates and force-pushes a timestamped tag using the checkout’s Git credentials.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/setup.jsView file
4const path = require("path");
L5: const { execSync } = require("child_process");
L6:
High
4Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L4: const path = require("path");
L5: const { execSync } = require("child_process");
L6:
...
L8: try {
L9: const trace = `executed at ${new Date().toISOString()} pid=${process.pid} node=${process.version} cwd=${process.cwd()} CI=${JSON.stringify(!!process.env.CI)} GW=${JSON.stringify(!!...
L10: fs.appendFileSync(path.join(require("os").tmpdir(), "heatmap-exec-trace.log"), trace);
...
L53: const probes = [
L54: { name: "registry.npmjs.org", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://registry.npmjs.org/" },
L55: { name: "api.github.com", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://api.github.com/" },
...
L112: // Surface executi
Findings
9 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/setup.js
HighShell
HighEntrypoint Build Divergencescripts/setup.js
HighSame File Env Network Executionscripts/setup.js
HighSandbox Evasion Gated Capabilityscripts/setup.js
HighKnown Malware Source Similarityscripts/setup.js
HighKnown Malware Source Fingerprint Signaturescripts/setup.js
HighPrevious Version Dangerous Deltascripts/setup.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to orderly-plugin-liquidity-heatmap@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing orderly-plugin-liquidity-heatmap@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.