pdf2epub@0.1.8
Convert PDF files to EPUB ebooks
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest activates a preinstall script that installs a fixed, unrelated GitHub project and marks its dependency as trusted. This unconsented install-time remote execution path warrants blocking, although the fetched project’s contents were not inspected.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing pdf2epub when Bun is available.
Impact
This permits remote package installation scripts to run during installation without an installer-specific opt-in.
Mechanism
The hook creates a temporary project, marks the demo dependency trusted, and runs bun add on the GitHub repository.
Attack narrative
During preinstall, the package checks for Bun and, if found, creates a temporary project that trusts a named demo dependency and installs it from a fixed GitHub repository. This creates an automatic remote installation path unrelated to PDF conversion; the fetched repository contents were not inspected.
AI rationale
The manifest activates a preinstall script that installs a fixed, unrelated GitHub project and marks its dependency as trusted. This unconsented install-time remote execution path warrants blocking, although the fetched project’s contents were not inspected.
Evidence
package.jsonlab/setups.mjs<tmpdir>/pdf2epub-demo-<pid>/package.json
Network endpoints1
github.com/daltsubnet/bun-install-helloworld-demo.git
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs lab/setups.mjs as a preinstall lifecycle script.
- When Bun is present, the script creates a temporary project and marks the named demo dependency as trusted.
- The script runs bun add against a fixed GitHub repository, an install-time remote action unrelated to PDF conversion.
Evidence against
- The remote install is conditional on Bun being available.
- The script writes its temporary package configuration outside the consumer project.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.preinstall = node lab/setups.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg9"scripts": {
"preinstall": "node lab/setups.mjs",
"start": "node pdf2epub.js",
High
Suspicious Lifecycle Evidence
package.json runs lab/setups.mjs as a preinstall lifecycle script.
package.jsonView on unpkg · L9lab/setups.mjsView file
28const bun = whichBun();
if (!bun) {
console.warn(
`[pdf2epub] bun not found — skip demo install. Manual: bun add ${DEMO_URL}.git`,
);
process.exit(0
High
Suspicious Dependency Evidence
When Bun is present, the script creates a temporary project and marks the named demo dependency as trusted.
lab/setups.mjsView on unpkg · L28Findings
6 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Dependency Evidencelab/setups.mjs
HighSuspicious Dependency Evidencelab/setups.mjs
HighSuspicious Dependency Evidencelab/setups.mjs
HighAi Review Evidencelab/setups.mjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to pdf2epub@0.1.8.
See all versions of pdf2epub for other recorded verdicts.
- Avoid installing pdf2epub@0.1.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.