registry / randompkga / 1.0.11

randompkga@1.0.11

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package executes a postinstall hook in the consumer project. The hook installs an additional undeclared package there.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of randompkga

Impact

Mutates the consumer project and stages execution of an unreviewed second package.

Mechanism

postinstall invokes npm i randompkgb in $INIT_CWD

Attack narrative

The package has no functional source files, but its postinstall hook changes into npm's initiating working directory and installs randompkgb. This causes an undeclared dependency to be fetched and installed in the consumer's project as a side effect of installing randompkga, creating a staged payload chain outside normal declared dependency resolution.

Rationale

The install-time hook deliberately mutates the invoking project by adding an unrelated package. This is concrete unconsented staged-package installation behavior.

Evidence

package.json$INIT_CWD

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall runs npm install in the invoking project's directory.
It installs undeclared package randompkgb during installation.

Evidence against

Package contains only package.json; no credential, network, or payload source is present.
Declared main index.js is absent.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.11",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "cd \"$INIT_CWD\" && npm i randompkgb"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L7

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

postinstall runs npm install in the invoking project's directory.

package.jsonView on unpkg · L5

High

Ai Review Evidence

It installs undeclared package randompkgb during installation.

package.jsonView on unpkg · L6

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = cd "$INIT_CWD" && npm i randompkgb

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = cd "$INIT_CWD" && npm i randompkgb

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "cd \"$INIT_CWD\" && npm i randompkgb" },

High

Suspicious Lifecycle Evidence

postinstall runs npm install in the invoking project's directory.

package.jsonView on unpkg · L5

6"scripts": { "postinstall": "cd \"$INIT_CWD\" && npm i randompkgb" },

High

Ai Review Evidence

Findings

1 Critical3 High1 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

LowScripts Present