registry / your-ai-workflow-firebase-os / 1.14.64

your-ai-workflow-firebase-os@1.14.64

Your AI Firebase — a complete Firebase-powered admin app in one React component.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Installing the package automatically rewrites files in the consuming project and adds a package-controlled Vite plugin. That plugin subsequently restores package-controlled versions of application entry files after user edits.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install runs the postinstall lifecycle hook.

Impact

A dependency takes persistent control of core consumer application and build configuration without an explicit setup command.

Mechanism

The hook edits consumer CSS, source files, package.json, and vite.config.ts; the added plugin writes canonical App.tsx and main.tsx content when it detects differences.

Attack narrative

On installation, the package modifies a consumer project rather than merely installing library files. It clears CSS, replaces source entry points, changes the consumer manifest, and injects its build plugin. The injected plugin treats App.tsx and main.tsx as owned and writes them back whenever they differ. The postinstall script also includes text aimed at explaining prior prompt-injection blocking, which is reviewer manipulation evidence.

AI rationale

This is an unconsented postinstall mutation of a foreign consumer project's application and build control surface, with persistence through a package-injected plugin. The behavior meets the install-hook abuse blocking boundary.

Evidence

package.jsonscripts/postinstall.jsscripts/patchViteConfig.jsdist/vite.es.jssrc/index.csssrc/App.csssrc/main.tsxsrc/App.tsxvite.config.ts.env

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest automatically runs a postinstall script.
The postinstall script clears consumer CSS and overwrites the consumer's main application entry files.
The install script changes the consumer manifest and Vite configuration to load the package's plugin.
The installed Vite plugin rewrites consumer App.tsx and main.tsx whenever they differ from package-controlled content.
The postinstall source contains reviewer-directed text about prompt injection and an earlier blocked install.

Evidence against

No outbound network request or credential-exfiltration sink was identified in the install script.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 50 file(s), 9.97 MB of source, external domains: 0.0.0.0, aistudio.google.com, api.resend.com, console.firebase.google.com, dashboard.stripe.com, developer.x.com, example.com, firebasestorage.googleapis.com, firestore.googleapis.com, fonts.googleapis.com, foo.bar, github.com, i.ytimg.com, motion.dev, ns.adobe.com, photon.komoot.io, platform.claude.com, platform.openai.com, player.vimeo.com, resend.com, securetoken.google.com, www.apache.org, www.googleapis.com, www.w3.org, www.xfa.org, www.youtube-nocookie.com, www.youtube.com, youraiworkflow.co

Source & flagged code

6 flagged

package.jsonView file

Lines 39-79json

39 "server.template.ts",

40 "scripts/postinstall.js",

41 "scripts/patchViteConfig.js",

42 "src/index.css",

43 "src/pages/Home.tsx",

44 "src/microcomponents/registry.ts",

45 "src/configs/theme.config.ts",

46 "src/configs/forms/registry.ts",

47 "src/configs/forms/contactForm.config.ts",

48 "src/configs/forms/supportForm.config.ts",

49 "src/configs/pages/registry.ts"

50 ],

51 "scripts": {

52 "dev": "vite",

53 "test": "vitest run",

54 "test:watch": "vitest",

55 "build": "tsc -b && vite build",

56 "build:lib": "vite build",

57 "lint": "eslint .",

58 "preview": "vite preview",

59 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "release": "npm version patch && npm run build:lib && npm pack",

61 "verify:dist": "node scripts/verifyDist.js",

62 "prepack": "node scripts/verifyDist.js",

63 "postinstall:content": "node scripts/dumpPostinstallContent.js"

64 },

65 "dependencies": {

66 "@eslint/js": "^9.39.4",

67 "@tailwindcss/vite": "^4.2.2",

68 "@types/node": "^24.12.0",

69 "@types/react": "^19.2.14",

70 "@types/react-dom": "^19.2.3",

71 "@vitejs/plugin-react": "^6.0.1",

72 "clsx": "^2.1.1",

73 "firebase": ">=10",

74 "framer-motion": "^12.38.0",

75 "fuse.js": "^7.3.0",

76 "iconoir": "^7.11.0",

77 "iconoir-react": "^7.11.0",

78 "lucide-react": "^1.47.0",

79 "react": ">=18",

dist/lucide-react-CWbDYh_b.cjsView file

1const e=require(`./chunk-CiTBaPhY.cjs`);let t=require(`react`);var n=e=>e?.replace(/([a-z0-9])([A-Z])/g,`$1-$2`).toLowerCase();function r(e,t,r=[]){if(t==null)throw Error(`[lucide]...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lucide-react-CWbDYh_b.cjsView on unpkg · L1

scripts/postinstall.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * your-ai-workflow-firebase-os postinstall script

4 *

5 * Runs automatically after `npm install your-ai-workflow-firebase-os`.

6 * Patches the consumer project so that <FirebaseOS /> renders correctly

7 * out of the box — no manual cleanup required.

8 *

9 * What it does:

10 * 1. Clears src/index.css and src/App.css to remove Vite default styling

dist/your-ai-workflow-firebase-os.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/your-ai-workflow-firebase-os.cssView on unpkg

dist/server.cjs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = your-ai-workflow-firebase-os@1.14.33 matchedIdentity = npm:[redacted]:1.14.33 similarity = 0.477 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.cjs.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lucide-react-CWbDYh_b.cjsView file

1const e=require(`./chunk-CiTBaPhY.cjs`);let t=require(`react`);var n=e=>e?.replace(/([a-z0-9])([A-Z])/g,`$1-$2`).toLowerCase();function r(e,t,r=[]){if(t==null)throw Error(`[lucide]...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lucide-react-CWbDYh_b.cjsView on unpkg · L1

scripts/postinstall.jsView file

17* L18: * It does NOT write GEMINI.md / AGENTS.md any more: AI Studio reserves those L19: * filenames for the developer's own instructions, and a package writing them ... L114: if (current.includes(CLEARED_MARKER)) continue; L115: fs.writeFileSync(filePath, `/* ${CLEARED_MARKER} postinstall */\n`); L116: console.log(` ✓ Cleared ${file} (was conflicting with your-ai-workflow-firebase-os styles)`); ... L149: const mainPath = path.join(srcDir, 'main.tsx'); L150: fs.writeFileSync(mainPath, withBanner(canonical ? canonical.main : FALLBACK_MAIN_TSX)); L151: console.log(' ✓ Wrote main.tsx (owned by Your AI Firebase — the build discards edits to it)'); ... L154: const fbosDir = path.join(srcDir, 'your-ai-workflow-firebase-os'); L155: if (!fs.existsSync(fbosDir)) fs.mkdirSync(fbosDir, { recur

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L17

dist/your-ai-workflow-firebase-os.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/your-ai-workflow-firebase-os.cssView on unpkg

dist/server.cjs.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.cjs.jsView on unpkg

Findings

1 Critical3 High5 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/your-ai-workflow-firebase-os.css

HighPrevious Version Dangerous Deltadist/server.cjs.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/lucide-react-CWbDYh_b.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to your-ai-workflow-firebase-os@1.14.64.

See version security history for other recorded verdicts.

Avoid installing your-ai-workflow-firebase-os@1.14.64. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-20 04:31:30.238Z (UTC).