registry / Install hook abuse / your-ai-workflow-firebase-os
your-ai-workflow-firebase-os
Your AI Firebase — a complete Firebase-powered admin app in one React component.
This report shows the evidence for your-ai-workflow-firebase-os@2.0.6. 25 of 55 known versions are blocked or flagged. The newest version, 2.0.13, is flagged. See all versions.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe package performs broad, unconsented consumer-project mutation during postinstall and installs a plugin that maintains its integration. This is concrete install-hook abuse even though no network exfiltration was observed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package runs its npm postinstall hook.
Impact
Consumer application code and build behavior can be replaced or persistently controlled without an explicit setup command.
Mechanism
The hook identifies the consumer root, overwrites application files, clears CSS, changes package.json and vite.config.ts, and injects the package build plugin.
Attack narrative
On installation, the package runs a script against the consuming project. It locates the project root, clears existing styles, replaces entry and application files, alters dependencies and Vite configuration, and injects its own build plugin. These actions occur automatically rather than through an explicit user setup command, creating a persistent install-hook supply-chain risk.
AI rationale
The package performs broad, unconsented consumer-project mutation during postinstall and installs a plugin that maintains its integration. This is concrete install-hook abuse even though no network exfiltration was observed.
Evidence
package.jsonscripts/postinstall.jsscripts/patchViteConfig.js
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package automatically runs a postinstall script.
- The postinstall locates the consumer project using INIT_CWD and its node_modules path.
- The install hook clears existing consumer CSS and overwrites src/main.tsx and src/App.tsx.
- The hook modifies the consumer package manifest and Vite configuration, adding the package build plugin.
- The Vite patch injects the package plugin when it is absent, supporting continuing control over the consumer build.
Evidence against
- No network transmission or credential collection was observed in the inspected install path.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/unlink-BVIiMTx_.cjsView file
1require(`./chunk-CiTBaPhY.cjs`);var e={name:`unlink`,size:24,node:[[`path`,{d:`m18.84 12.25 1.72-1.71h-.02a5.004 5.004 0 0 0-.12-7.07 5.006 5.006 0 0 0-6.95 0l-1.72 1.71`,key:`yqzx...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/unlink-BVIiMTx_.cjsView on unpkg · L1scripts/postinstall.jsView file
17*
L18: * It does NOT write GEMINI.md / AGENTS.md any more: AI Studio reserves those
L19: * filenames for the developer's own instructions, and a package writing them
...
L114: if (current.includes(CLEARED_MARKER)) continue;
L115: fs.writeFileSync(filePath, `/* ${CLEARED_MARKER} postinstall */\n`);
L116: console.log(` ✓ Cleared ${file} (was conflicting with your-ai-workflow-firebase-os styles)`);
...
L149: const mainPath = path.join(srcDir, 'main.tsx');
L150: fs.writeFileSync(mainPath, withBanner(canonical ? canonical.main : FALLBACK_MAIN_TSX));
L151: console.log(' ✓ Wrote main.tsx (owned by Your AI Firebase — the build discards edits to it)');
...
L154: const fbosDir = path.join(srcDir, 'your-ai-workflow-firebase-os');
L155: if (!fs.existsSync(fbosDir)) fs.mkdirSync(fbosDir, { recur
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/postinstall.jsView on unpkg · L17dist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1View on unpkgFindings
1 Critical2 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/unlink-BVIiMTx_.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to your-ai-workflow-firebase-os@2.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing your-ai-workflow-firebase-os@2.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
55 known versions2.0.13latestSuspiciousDestructive ActionWarnPublishedSep 29, 2026, 2:18 AM2.0.11SuspiciousDestructive ActionWarnPublishedSep 27, 2026, 1:50 PM2.0.6shownMaliciousInstall Hook AbuseBlockPublishedSep 27, 2026, 1:33 AM2.0.3Clean—AllowPublishedSep 25, 2026, 5:11 AM2.0.0Scan Failed—AllowUnder ReviewSep 23, 2026, 10:51 AM1.14.68MaliciousDestructive ActionBlockPublishedSep 22, 2026, 2:22 PM1.14.67SuspiciousInstall Hook AbuseWarnPublishedSep 22, 2026, 9:31 AM1.14.66SuspiciousInstall Hook AbuseWarnPublishedSep 22, 2026, 2:56 AM1.14.65SuspiciousDestructive ActionWarnPublishedSep 20, 2026, 10:38 PM1.14.64MaliciousInstall Hook AbuseBlockPublishedSep 20, 2026, 3:05 AM1.14.63Scan Failed—AllowUnder ReviewSep 18, 2026, 10:08 AM1.14.58Scan Failed—AllowUnder ReviewSep 17, 2026, 11:44 PM1.14.57Scan Failed—AllowUnder ReviewSep 17, 2026, 3:35 PM1.14.56Scan Failed—AllowUnder ReviewSep 17, 2026, 3:16 PM1.14.55Scan Failed—AllowUnder ReviewSep 17, 2026, 11:09 AM1.14.54Scan Failed—AllowUnder ReviewSep 17, 2026, 10:34 AM1.14.51Scan Failed—AllowUnder ReviewSep 17, 2026, 7:30 AM1.14.50Scan Failed—AllowUnder ReviewSep 17, 2026, 6:07 AM1.14.49Scan Failed—AllowUnder ReviewSep 17, 2026, 3:28 AM1.14.48Scan Failed—AllowUnder ReviewSep 16, 2026, 10:30 AM1.14.47Scan Failed—AllowUnder ReviewSep 16, 2026, 7:21 AM1.14.43Scan Failed—AllowUnder ReviewSep 16, 2026, 1:21 AM1.14.41MaliciousInstall Hook AbuseBlockPublishedSep 15, 2026, 11:07 AM1.14.33SuspiciousAgent extension lifecycle riskWarnPublishedSep 15, 2026, 1:26 AM1.14.31SuspiciousAgent extension lifecycle riskWarnPublishedSep 14, 2026, 1:11 PM1.14.29SuspiciousInstall Hook AbuseWarnPublishedSep 14, 2026, 6:36 AM1.14.28MaliciousInstall Hook AbuseBlockPublishedSep 14, 2026, 2:03 AM1.14.27MaliciousInstall Hook AbuseBlockPublishedSep 13, 2026, 8:36 AM1.14.24MaliciousInstall Hook AbuseBlockPublishedSep 11, 2026, 8:55 AM1.14.23SuspiciousAgent extension lifecycle riskWarnPublishedSep 11, 2026, 2:41 AM1.14.22MaliciousInstall Hook AbuseBlockPublishedSep 10, 2026, 10:11 AM1.14.20Scan Failed—AllowUnder ReviewSep 10, 2026, 4:26 AM1.14.18MaliciousInstall Hook AbuseBlockPublishedSep 9, 2026, 2:24 PM1.14.17MaliciousInstall Hook AbuseBlockPublishedSep 9, 2026, 10:50 AM1.14.16SuspiciousInstall Hook AbuseWarnPublishedSep 9, 2026, 6:15 AM1.14.14MaliciousInstall Hook AbuseBlockPublishedSep 8, 2026, 2:17 PM1.14.12MaliciousInstall Hook AbuseBlockPublishedSep 8, 2026, 8:55 AM1.14.10SuspiciousInstall Hook AbuseWarnPublishedSep 7, 2026, 2:53 PM1.14.9MaliciousInstall Hook AbuseBlockPublishedSep 7, 2026, 2:32 PM1.14.7MaliciousInstall Hook AbuseBlockPublishedSep 7, 2026, 1:33 PM1.14.5MaliciousInstall Hook AbuseBlockPublishedSep 7, 2026, 12:32 PM1.14.4MaliciousInstall Hook AbuseBlockPublishedSep 7, 2026, 11:27 AM1.9.0SuspiciousInstall Hook AbuseWarnPublishedSep 5, 2026, 8:16 AM1.8.0SuspiciousInstall Hook AbuseWarnPublishedSep 5, 2026, 5:32 AM1.7.0SuspiciousInstall Hook AbuseWarnPublishedSep 5, 2026, 4:12 AM1.6.5SuspiciousInstall Hook AbuseWarnPublishedSep 5, 2026, 3:11 AM1.6.1MaliciousInstall Hook AbuseBlockPublishedSep 4, 2026, 12:09 PM1.4.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 8:53 AM1.3.0MaliciousInstall Hook AbuseBlockPublishedSep 4, 2026, 8:36 AM1.2.60MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 4:09 AM1.2.59MaliciousInstall Hook AbuseBlockPublishedSep 4, 2026, 3:40 AM1.2.58MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 3, 2026, 3:41 PM1.2.35MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 1, 2026, 10:25 AM1.2.34MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 4:38 AM1.2.32MaliciousInstall Hook AbuseBlockPublishedAug 31, 2026, 10:51 AM