snyk@1.1308.1
snyk library and cli utility
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe postinstall behavior is a package-aligned CLI download with checksum validation. The flagged NuGet archive is used as an offline parser dependency, and the inspected runtime source did not establish a concrete attack surface.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the postinstall bootstrap; the CLI monitor flow runs when invoked.
Impact
No concrete harmful effect was established from the inspected source.
Mechanism
The wrapper downloads from Snyk distribution hosts and validates the executable checksum. The bundled NuGet package is copied to a local offline source for parser setup.
AI rationale
The postinstall behavior is a package-aligned CLI download with checksum validation. The flagged NuGet archive is used as an offline parser dependency, and the inspected runtime source did not establish a concrete attack surface.
Evidence
package.jsonwrapper_dist/bootstrap.jswrapper_dist/common.jsdist/cli/778.index.jsdist/cli/905.index.jsdist/cli/724.index.js
Network endpoints2
downloads.snyk.iostatic.snyk.io
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest's postinstall runs the wrapper bootstrap to download the Snyk CLI.
- The wrapper downloads from Snyk hosts and checks the executable's SHA-256 against its expected checksum; a missing checksum becomes an unmatched value.
- The inspected archive analysis identifies the shipped archive as NuGet.Frameworks 6.14.3 by Microsoft; CLI code copies bundled NuGet packages into an offline source for a generated .NET framework parser.
- The bundled ZIP helper checks symlink targets to avoid following links outside an archive root.
- The CLI monitor entry point checks for an API or OAuth token before selecting a monitoring flow.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
18 flaggedpackage.jsonView file
•dependencies registry_only=boolean,roarr
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg•scripts.postinstall = node wrapper_dist/bootstrap.js exec
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node wrapper_dist/bootstrap.js exec
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgwrapper_dist/common.jsView file
Findings
1 Critical7 High10 Medium7 Low
CriticalManifest Confusionpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processwrapper_dist/common.js
HighShellwrapper_dist/common.js
HighSame File Env Network Executionwrapper_dist/common.js
HighShips High Entropy Blobdist/cli/nupkgs/nuget.frameworks.6.14.3.nupkg
HighSemantic Analysis Limiteddist/cli/905.index.js
HighPrevious Version Dangerous Deltadist/cli/724.index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirewrapper_dist/bootstrap.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to snyk@1.1308.1.
See all versions of snyk for other recorded verdicts.
- Review the evidence and your use of snyk@1.1308.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.