your-ai-workflow-firebase-os@1.14.67
Your AI Firebase — a complete Firebase-powered admin app in one React component.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic lifecycle hook has a concrete, broad consumer-project mutation capability. Its transparent source and lack of observed exfiltration or remote execution support a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package with npm.
Impact
A package installation can unexpectedly alter and discard consumer-project code and configuration.
Mechanism
The lifecycle script clears CSS, replaces application entry files, alters package.json, and patches vite.config.ts.
AI rationale
The automatic lifecycle hook has a concrete, broad consumer-project mutation capability. Its transparent source and lack of observed exfiltration or remote execution support a warning rather than a block.
Evidence
package.jsonscripts/postinstall.jsscripts/patchViteConfig.js
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package automatically runs a postinstall script during npm installation.
- That script clears existing consumer CSS files and overwrites consumer src/main.tsx and src/App.tsx.
- The install hook also modifies the consumer package.json and vite.config.ts to add dependencies and a package build plugin.
Evidence against
- No network transmission, shell execution, credential harvesting, or self-dependency was found in the inspected lifecycle code.
- The postinstall changes are explicit in source and scoped to a detected consumer project.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/PhoneInputField-p60Pe2nE.cjsView file
1require(`./chunk-CiTBaPhY.cjs`);const e=require(`./PhoneInputField-m6STmA8A.cjs`);exports.default=e.t;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/PhoneInputField-p60Pe2nE.cjsView on unpkg · L1Findings
1 Critical3 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/your-ai-workflow-firebase-os.css
HighPrevious Version Dangerous Deltadist/validate-BG8U4JYB.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/PhoneInputField-p60Pe2nE.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to your-ai-workflow-firebase-os@1.14.67.
See all versions of your-ai-workflow-firebase-os for other recorded verdicts.
- Review the evidence and your use of your-ai-workflow-firebase-os@1.14.67 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.