registry / randompkga / 1.0.6

randompkga@1.0.6

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installing this package triggers a preinstall hook that installs randompkgb through rnpm. This is an unconsented install-time staged dependency action.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation of randompkga

Impact

Can alter the consuming project and stage execution of code from randompkgb during installation.

Mechanism

preinstall-driven secondary package installation

Attack narrative

The package's only implementation is a preinstall command that runs `rnpm i randompkgb`. Thus merely installing randompkga causes a second package to be fetched and installed outside the declared dependency manifest, creating a staged payload path during installation.

Rationale

The explicit preinstall hook performs an unconsented secondary package installation. This is concrete install-hook abuse even though the package itself contains no direct exfiltration or network code.

Evidence

package.json

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines a preinstall lifecycle hook.
The hook invokes `rnpm i randompkgb`, causing an additional package installation during npm install.

Evidence against

No other package source files are present.
No direct network endpoint, credential access, or destructive command is declared.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.6",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "echo BEFORE && rnpm i randompkgb && echo INSTALL_SUCCEEDED"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The hook invokes `rnpm i randompkgb`, causing an additional package installation during npm install.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

package.json defines a preinstall lifecycle hook.

package.jsonView on unpkg · L6

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = echo BEFORE && rnpm i randompkgb && echo INSTALL_SUCCEEDED

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "echo BEFORE && rnpm i randompkgb && echo INSTALL_SUCCEEDED" }

High

Suspicious Lifecycle Evidence

package.json defines a preinstall lifecycle hook.

package.jsonView on unpkg · L6

7"preinstall": "echo BEFORE && rnpm i randompkgb && echo INSTALL_SUCCEEDED"

High

Ai Review Evidence

The hook invokes `rnpm i randompkgb`, causing an additional package installation during npm install.

package.jsonView on unpkg · L7

•scripts.preinstall = echo BEFORE && rnpm i randompkgb && echo INSTALL_SUCCEEDED

Medium

Findings

3 High1 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

LowScripts Present