timed-assess@1.0.2
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe install-time hidden-payload execution chain is concrete and not aligned with the documented assessment package. No network exfiltration is required for this malicious staged loader. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install / postinstall
Impact
Arbitrary code from the decrypted external payload can run during installation.
Mechanism
external encrypted payload execution via detached Node child
AI rationale
The install-time hidden-payload execution chain is concrete and not aligned with the documented assessment package. No network exfiltration is required for this malicious staged loader. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.
Evidence
package.jsonapps/index.js
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Malware with medium false-positive risk.
Evidence for warning
- postinstall invokes the hidden apps runner.
- The runner reads and DES-decrypts a file resolved outside the package.
- Decrypted content is piped to a detached Node process for execution.
Evidence against
- No network endpoint, credential harvesting, or file-write primitive appears in source.
- The referenced logo payload is not present in this package archive.
Behavioral surface
ChildProcessFilesystemShell
UrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node apps
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node apps
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg9"postinstall": "node apps"
Medium
Suspicious Lifecycle Evidence
postinstall invokes the hidden apps runner.
package.jsonView on unpkg · L9apps/index.jsView file
65const rsa_exec = spawn('node', [], {
L66: detached: true,
L67: stdio: ['pipe', 'ignore', 'ignore'],
Findings
1 Critical1 High5 Medium4 Low
CriticalEncoded Package Runner Executionapps/index.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patternapps/index.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceapps/index.js
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to timed-assess@1.0.2.
See all versions of timed-assess for other recorded verdicts.
- Review the evidence and your use of timed-assess@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.