pit-js@5.1.0
Pollable Input
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe preinstall hook automatically changes Git hook configuration and has no visible consent guard. That creates a concrete install-time integrity risk, so this package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package with npm or another package manager that runs preinstall.
Impact
The repository’s Git hook behavior may be redirected to a path that is absent from the published package.
Mechanism
The hook invokes git config to set core.hooksPath to git_hooks, without a consent check.
Attack narrative
During installation, the package runs a Git configuration command that sets core.hooksPath to git_hooks. Git may resolve the consumer repository from the package’s nested installation directory, changing which hooks run for that repository.
AI rationale
The preinstall hook automatically changes Git hook configuration and has no visible consent guard. That creates a concrete install-time integrity risk, so this package should be blocked.
Evidence
package.json
Decision evidence
public snapshotAI called this Malicious at 87.0% confidence as Malware with low false-positive risk.
Evidence for block
- The preinstall hook runs a Git configuration command that changes core.hooksPath to git_hooks.
Evidence against
- The package entrypoint exports input-controller and vector utilities.
Behavioral surface
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = yarn config-hooks
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg19"preinstall": "yarn config-hooks",
"config-hooks": "git config core.hooksPath git_hooks",
"create-tag": "node tasks/app/create_tag.m
High
Suspicious Lifecycle Evidence
The preinstall hook runs a Git configuration command that changes core.hooksPath to git_hooks.
package.jsonView on unpkg · L19•scripts.preinstall = yarn config-hooks
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/index.tsView file
Findings
3 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencesrc/index.ts
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
Affected versions and remediation
This report applies to pit-js@5.1.0.
See all versions of pit-js for other recorded verdicts.
- Avoid installing pit-js@5.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.