registry / randompkga / 1.0.4

randompkga@1.0.4

AI Security Review

scanned 3h ago · by lpm-firewall-ai

On npm installation, the package runs an external CLI to install randompkgb outside declared dependencies. The invoked executable and secondary package are not present in this package, so no payload is confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

May cause an untracked secondary package installation if rnpm is available.

Mechanism

lifecycle invocation of an external package-install command

Rationale

The lifecycle hook creates a real supply-chain risk through an external, undeclared install action, but source inspection does not establish a concrete malicious payload. Warn rather than block.

Evidence

package.json

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install-time postinstall invokes `rnpm i randompkgb`, attempting an undeclared secondary installation.

Evidence against

Package contains only package.json; declared main index.js is absent.
No source evidence of network endpoints, credential access, file harvesting, shell payloads, or AI-agent configuration writes.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.4",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "rnpm i randompkgb"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

Medium

Suspicious Lifecycle Evidence

Install-time postinstall invokes `rnpm i randompkgb`, attempting an undeclared secondary installation.

package.jsonView on unpkg · L5

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = rnpm i randompkgb

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = rnpm i randompkgb

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

5"main": "index.js", "scripts": { "postinstall": "rnpm i randompkgb" },

Medium

Suspicious Lifecycle Evidence

Install-time postinstall invokes `rnpm i randompkgb`, attempting an undeclared secondary installation.

package.jsonView on unpkg · L5

Findings

1 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present