stretchshop@0.7.8
Fast & scalable e-commerce
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe install hook conditionally executes unpinned downloaded code, warranting a warning. The flagged fulfillment code is ordinary commerce logic, and no concrete malware behavior supports blocking.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Installation when required asset directories are missing; downloaded-script execution additionally requires the consumer-directory check to fail.
Impact
Changed upstream demo code could execute with installer privileges; demo assets are also copied into the project.
Mechanism
An unpinned git clone supplies db/demo_data.js, which is executed through childProcess.fork when changePath remains empty.
AI rationale
The install hook conditionally executes unpinned downloaded code, warranting a warning. The flagged fulfillment code is ordinary commerce logic, and no concrete malware behavior supports blocking.
Evidence
package.jsondemo/demo.jspublicresourcesservicesmoleculer.config.js.env
Network endpoints1
github.com/StretchShop/StretchShop-demo-data.git
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json automatically runs demo/demo.js with the base argument after installation.
- demo/demo.js clones a fixed StretchShop demo repository without pinning a revision.
- The base argument suppresses database-script execution only when the relative consumer node_modules directory exists; otherwise the downloaded script is forked.
- The flagged order-fulfillment file writes invoice PDFs and handles order notifications.
Evidence against
- The repository belongs to the package's stated vendor, and the installer transparently copies demo assets without overwriting existing files.
- No runtime self-dependency, obfuscation, credential exfiltration, or AI-agent control mutation was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node demo/demo.js base
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node demo/demo.js base
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdemo/demo.jsView file
1const path = require("path");
L2: const childProcess = require("child_process");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
demo/demo.jsView on unpkg · L1Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltaservices/orders/methods/order-fulfillment.methods.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredemo/demo.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to stretchshop@0.7.8.
See all versions of stretchshop for other recorded verdicts.
- Review the evidence and your use of stretchshop@0.7.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.