orderly-plugin-liquidity-heatmap@1.0.4
Adds a liquidity heatmap overlay to the Orderly orderbook widget
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe postinstall hook makes authenticated, unrequested remote repository changes and stores collected CI identity metadata. This is concrete install-triggered attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package in CI with GITHUB_WORKSPACE set; repository writes proceed when GITHUB_TOKEN and GITHUB_REPOSITORY are available.
Impact
The hook makes unrequested changes to the consumer's remote repository and stores runner-identifying metadata there.
Mechanism
The hook sends the snapshot to the GitHub repository contents API with GITHUB_TOKEN, then force-pushes a timestamped tag through the checkout's origin.
Attack narrative
The postinstall hook runs in CI, collects host, user, workflow, and runner details, then uses the workflow token to write that snapshot into the repository and force-push a tag. The source shows no consent check for either remote mutation.
AI rationale
The postinstall hook makes authenticated, unrequested remote repository changes and stores collected CI identity metadata. This is concrete install-triggered attack behavior.
Evidence
package.jsonscripts/setup.jsheatmap-setup-report.jsonGit tag heatmap-setup-<timestamp>
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/setup.js automatically during postinstall.
- The script proceeds when both CI and GITHUB_WORKSPACE are set.
- It collects host, user, repository, workflow, and runner metadata.
- It sends the snapshot to the repository contents API using GITHUB_TOKEN.
- It force-pushes a timestamped tag to the checkout's origin.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/setup.jsView file
4const path = require("path");
L5: const { execSync } = require("child_process");
L6:
High
4Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L4: const path = require("path");
L5: const { execSync } = require("child_process");
L6:
...
L8: try {
L9: const trace = `executed at ${new Date().toISOString()} pid=${process.pid} node=${process.version} cwd=${process.cwd()} CI=${JSON.stringify(!!process.env.CI)} GW=${JSON.stringify(!!...
L10: fs.appendFileSync(path.join(require("os").tmpdir(), "heatmap-exec-trace.log"), trace);
...
L53: const probes = [
L54: { name: "registry.npmjs.org", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://registry.npmjs.org/" },
L55: { name: "api.github.com", cmd: "curl -s -o /dev/null -w %{http_code} -m 5 https://api.github.com/" },
...
L112: // Surface executi
Findings
9 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/setup.js
HighShell
HighEntrypoint Build Divergencescripts/setup.js
HighSame File Env Network Executionscripts/setup.js
HighSandbox Evasion Gated Capabilityscripts/setup.js
HighKnown Malware Source Similarityscripts/setup.js
HighKnown Malware Source Fingerprint Signaturescripts/setup.js
HighPrevious Version Dangerous Deltascripts/setup.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to orderly-plugin-liquidity-heatmap@1.0.4.
See all versions of orderly-plugin-liquidity-heatmap for other recorded verdicts.
- Avoid installing orderly-plugin-liquidity-heatmap@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.