your-ai-workflow-firebase-os@1.14.66
Your AI Firebase — a complete Firebase-powered admin app in one React component.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiAutomatic broad mutation of consumer source and build configuration is a meaningful install-hook risk. The inspected source does not establish a blocking malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package invokes its postinstall hook.
Impact
An install can overwrite project styling and application configuration without a separate setup command.
Mechanism
The hook clears consumer CSS, writes application files, alters package.json, and injects a Vite plugin.
AI rationale
Automatic broad mutation of consumer source and build configuration is a meaningful install-hook risk. The inspected source does not establish a blocking malicious chain.
Evidence
package.jsonscripts/postinstall.jsscripts/patchViteConfig.jssrc/index.csssrc/App.csssrc/main.tsxsrc/App.tsxvite.config.ts.env
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package automatically runs its postinstall script.
- The install script targets the consumer project and clears existing CSS before replacing owned application files.
- The install script changes the consumer manifest and Vite configuration to add dependencies and its build plugin.
Evidence against
- No credential collection, shell execution, or network send was identified in the installer.
- The generated environment file contains empty Firebase placeholders rather than harvested values.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/your-ai-workflow-firebase-os.cjs.jsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunk-CiTBaPhY.cjs`),t=require(`./ContactPopup-js3wYzEr.cjs`),n=require(`./verifiedAccount-D3O...
L2: `);return a?(0,u.jsx)(`div`,{className:`prompt-card`,hidden:!0}):(0,u.jsxs)(`div`,{className:`prompt-card flex flex-col gap-2 min-w-0 max-w-full rounded-2xl border border-[var(--pa...
Medium
Findings
1 Critical3 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/your-ai-workflow-firebase-os.css
HighPrevious Version Dangerous Deltadist/server.cjs.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/your-ai-workflow-firebase-os.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to your-ai-workflow-firebase-os@1.14.66.
See all versions of your-ai-workflow-firebase-os for other recorded verdicts.
- Review the evidence and your use of your-ai-workflow-firebase-os@1.14.66 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.