registry / randompkga / 1.0.5

randompkga@1.0.5

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package triggers an undeclared external `rnpm` install command for another package. No source establishes a more concrete payload or data-exfiltration path.

Static reason

One or more suspicious static signals were detected.

Trigger

npm dependency installation

Impact

May mutate the consumer project or execute behavior supplied by the external CLI/package.

Mechanism

postinstall invokes an external CLI to install another package

Rationale

The postinstall hook is a real unexplained install-time mutation/execution risk, but the inspected source does not prove a concrete malicious chain. It warrants a warning rather than a block.

Evidence

package.json

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install-time postinstall invokes `rnpm i randompkgb`, causing an external CLI/package-install action during dependency installation.
The package contains only its manifest, so the lifecycle action cannot be justified by package source.

Evidence against

No package JavaScript source, network endpoint, credential access, shell payload, or AI-agent configuration write is present.
The manifest does not contain preinstall or install hooks.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-17json

2 "name": "randompkga",

3 "version": "1.0.5",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "rnpm i randompkgb"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

Medium

Suspicious Lifecycle Evidence

Install-time postinstall invokes `rnpm i randompkgb`, causing an external CLI/package-install action during dependency installation.

package.jsonView on unpkg · L6

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs",

13 "allowScripts": {

14 "allowed": ["postinstall"]

15 }

16}

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = rnpm i randompkgb

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = rnpm i randompkgb

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

6"scripts": { "postinstall": "rnpm i randompkgb" }

Medium

Suspicious Lifecycle Evidence

Install-time postinstall invokes `rnpm i randompkgb`, causing an external CLI/package-install action during dependency installation.

package.jsonView on unpkg · L6

Findings

1 High2 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSuspicious Lifecycle Evidencepackage.json

LowScripts Present