registry / randompkga / 1.0.8

randompkga@1.0.8

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing randompkga runs npm before installation completes. It changes into the consuming project and installs an unrelated, unpinned package.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of randompkga

Impact

Unconsented dependency installation and execution in the consumer project; the fetched package controls the subsequent payload.

Mechanism

preinstall hook installs external randompkgb from the parent directory

Attack narrative

The preinstall hook executes automatically when this package is installed, changes to the parent (consumer) project, and runs npm i randompkgb. This introduces an unpinned external package into the consumer environment without an explicit user action, allowing that package's lifecycle code to execute and mutate the project.

Rationale

The manifest contains a concrete install-time supply-chain action outside its own package directory, with no package functionality to justify it. This is malicious installation behavior rather than a static-label-only finding.

Evidence

package.json../package.json../node_modules/randompkgb

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines a preinstall hook that executes during installation.
The hook leaves the package directory and installs unpinned randompkgb into the parent project.

Evidence against

The extracted package contains only package.json; no additional runtime source or network endpoint is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.8",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "cd .. && npm i randompkgb"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L7

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

High

Ai Review Evidence

The hook leaves the package directory and installs unpinned randompkgb into the parent project.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

package.json defines a preinstall hook that executes during installation.

package.jsonView on unpkg · L6

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = cd .. && npm i randompkgb

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = cd .. && npm i randompkgb

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "preinstall": "cd .. && npm i randompkgb" }

High

Suspicious Lifecycle Evidence

package.json defines a preinstall hook that executes during installation.

package.jsonView on unpkg · L6

7"preinstall": "cd .. && npm i randompkgb"

High

Ai Review Evidence

The hook leaves the package directory and installs unpinned randompkgb into the parent project.

Findings

1 Critical3 High1 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

LowScripts Present