orderly-plugin-liquidity-heatmap@1.0.2
Adds a liquidity heatmap overlay to the Orderly orderbook widget
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe install hook performs an automatic authenticated write to the consumer’s repository, and the package runtime entrypoint does not implement the advertised heatmap behavior. This is concrete install-hook abuse and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installing the package in a GitHub Actions environment with a workspace; the repository write also requires a GitHub token and repository context.
Impact
The package causes an unrequested repository history change and stores collected runner and repository metadata in the consumer’s repository.
Mechanism
The hook authenticates to GitHub’s API and creates or updates a report file on the repository’s default branch.
Attack narrative
During postinstall in GitHub Actions, the package records runner and repository details. If the workflow exposes a GitHub token, it uses that token to commit the report into the consumer’s repository without a consent check for that write.
AI rationale
The install hook performs an automatic authenticated write to the consumer’s repository, and the package runtime entrypoint does not implement the advertised heatmap behavior. This is concrete install-hook abuse and warrants blocking publication.
Evidence
package.jsonscripts/setup.jsheatmap-setup-report.json
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/setup.js automatically during postinstall.
- The setup hook runs when both CI and the GitHub workspace are present.
- The hook records runner identity and repository context, including host, user, working directory, and repository.
- When a GitHub token and repository are available, the hook authenticates to GitHub’s API with that token.
- The hook sends a PUT request to commit the captured report into the consumer repository.
Evidence against
- The hook exits outside its CI condition; this limits when the behavior runs but does not require consent for the repository write.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/setup.jsView file
4const path = require("path");
L5: const { execSync } = require("child_process");
L6:
High
4Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L4: const path = require("path");
L5: const { execSync } = require("child_process");
L6:
L7: const isCI = !!process.env.CI && !!process.env.GITHUB_WORKSPACE;
L8: if (!isCI) {
...
L14: capturedAt: new Date().toISOString(),
L15: host: os.hostname(),
L16: platform: `${os.type()} ${os.release()}`,
...
L38: const probes = [
L39: { name: "registry.npmjs.org", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://registry.npmjs.org/" },
L40: { name: "api.github.com", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://api.github.com/" },
...
L97: // Surface execution through GitHub Actions primitives so it is visible via the
Findings
7 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/setup.js
HighShell
HighEntrypoint Build Divergencescripts/setup.js
HighSame File Env Network Executionscripts/setup.js
HighSandbox Evasion Gated Capabilityscripts/setup.js
HighPrevious Version Dangerous Deltascripts/setup.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to orderly-plugin-liquidity-heatmap@1.0.2.
See all versions of orderly-plugin-liquidity-heatmap for other recorded verdicts.
- Avoid installing orderly-plugin-liquidity-heatmap@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.