snyk@1.1307.2
snyk library and cli utility
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has an automatic install-time remote executable downloader, which warrants a warning because some bundled binary content remains opaque to static source inspection. The inspected implementation is consistent with a legacy CLI wrapper and does not establish malicious intent or behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation runs the postinstall script.
Impact
A remote binary is introduced into the installed package, so a registry consumer must trust the package's bundled checksum and release process.
Mechanism
Install-time verified remote executable download.
AI rationale
The package has an automatic install-time remote executable downloader, which warrants a warning because some bundled binary content remains opaque to static source inspection. The inspected implementation is consistent with a legacy CLI wrapper and does not establish malicious intent or behavior.
Evidence
package.jsonwrapper_dist/bootstrap.jswrapper_dist/common.jssrc/common.tswrapper_dist/snyk-macoswrapper_dist/snyk-macos-arm64wrapper_dist/snyk-win.exewrapper_dist/snyk-alpinewrapper_dist/snyk-alpine-arm64wrapper_dist/snyk-linuxwrapper_dist/snyk-linux-arm64
Network endpoints2
downloads.snyk.iostatic.snyk.io
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install lifecycle automatically invokes a bootstrap downloader.
- The downloader fetches a platform executable and makes it executable during installation.
- The package includes a binary NuGet archive and generated bundled components, limiting source-level inspection of all shipped code.
Evidence against
- The download URLs are Snyk-owned hosts and the executable is checked against a packaged SHA-256 value before replacement.
- The inspected bundled files are a ZIP library and a marked markdown parser, not hidden install logic.
- No self-dependency, credential harvesting, broad project mutation, or AI-agent configuration changes were found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
18 flaggedpackage.jsonView file
•dependencies registry_only=boolean,roarr
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•scripts.postinstall = node wrapper_dist/bootstrap.js exec
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node wrapper_dist/bootstrap.js exec
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgwrapper_dist/common.jsView file
Findings
1 Critical7 High10 Medium7 Low
CriticalManifest Confusionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processwrapper_dist/common.js
HighShellsrc/common.ts
HighSame File Env Network Executionwrapper_dist/common.js
HighShips High Entropy Blobdist/cli/nupkgs/nuget.frameworks.6.14.3.nupkg
HighSemantic Analysis Limiteddist/cli/905.index.js
HighPrevious Version Dangerous Deltadist/cli/970.index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirewrapper_dist/bootstrap.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to snyk@1.1307.2.
See all versions of snyk for other recorded verdicts.
- Review the evidence and your use of snyk@1.1307.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.