your-ai-workflow-firebase-os@1.2.34: Malicious npm security | LPM Firewall

Loading npm security reports…

your-ai-workflow-firebase-os@1.2.34: Malicious npm security | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

32"scripts": { "dev": "vite", "test": "vitest run", "test:watch": "vitest", "build": "tsc -b && vite build", "build:lib": "vite build", "lint": "eslint .", "preview": "vite preview", "postinstall": "node scripts/postinstall.js", "release": "npm version patch && npm run build:lib && npm pack" },

High

Suspicious Lifecycle Evidence

The npm postinstall hook runs automatically during installation.

package.jsonView on unpkg · L32

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

20Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, sensitive-file+network L20: // Walk up from node_modules/your-ai-workflow-firebase-os/scripts/ to find the consumer project root L21: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L22: // __dirname = <consumer>/node_modules/your-ai-workflow-firebase-os/scripts ... L25: // Only run when we are truly installed inside a consumer (not during our own dev) L26: const consumerPkg = path.join(consumerRoot, 'package.json'); L27: if (!fs.existsSync(consumerPkg)) { ... L33: try { L34: pkgJson = JSON.parse(fs.readFileSync(consumerPkg, 'utf8')); L35: } catch { ... L480: tabName: 'Invoices', L481: iconName: 'receipt', // exact name from https://lucide.dev/icons/ L

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.jsView on unpkg · L20

dist/your-ai-workflow-firebase-os.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/your-ai-workflow-firebase-os.cssView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 12-60json

12 "require": "./dist/your-ai-workflow-firebase-os.cjs.js",

13 "types": "./dist/index.d.ts"

14 },

15 "./renderer": {

16 "import": "./dist/renderer.es.js",

17 "require": "./dist/renderer.cjs.js",

18 "types": "./dist/renderer.d.ts"

19 },

20 "./styles.css": {

21 "default": "./dist/your-ai-workflow-firebase-os.css"

22 },

23 "./dist/your-ai-workflow-firebase-os.css": {

24 "default": "./dist/your-ai-workflow-firebase-os.css"

25 }

26 },

27 "files": [

28 "dist",

29 "scripts",

30 "src"

31 ],

32 "scripts": {

33 "dev": "vite",

34 "test": "vitest run",

35 "test:watch": "vitest",

36 "build": "tsc -b && vite build",

37 "build:lib": "vite build",

38 "lint": "eslint .",

39 "preview": "vite preview",

40 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "release": "npm version patch && npm run build:lib && npm pack"

42 },

High

Suspicious Lifecycle Evidence

The npm postinstall hook runs automatically during installation.

package.jsonView on unpkg · L32

43 "dependencies": {

44 "@eslint/js": "^9.39.4",

45 "@tailwindcss/vite": "^4.2.2",

46 "@types/node": "^24.12.0",

47 "@types/react": "^19.2.14",

48 "@types/react-dom": "^19.2.3",

49 "@vitejs/plugin-react": "^6.0.1",

50 "clsx": "^2.1.1",

51 "firebase": ">=10",

52 "framer-motion": "^12.38.0",

53 "fuse.js": "^7.3.0",

54 "iconoir": "^7.11.0",

55 "iconoir-react": "^7.11.0",

56 "lucide-react": "^1.7.0",

57 "react": ">=18",

58 "react-dom": ">=18",

59 "react-dropzone": "^15.0.0",

60 "react-international-phone": "^4.8.0",

scripts/postinstall.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * your-ai-workflow-firebase-os postinstall script

4 *

5 * Runs automatically after `npm install your-ai-workflow-firebase-os`.

6 * Patches the consumer project so that <FirebaseOS /> renders correctly

7 * out of the box — no manual cleanup required.

8 *

9 * What it does:

10 * 1. Clears src/index.css and src/App.css to remove Vite default styling

11

dist/your-ai-workflow-firebase-os.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/your-ai-workflow-firebase-os.cssView on unpkg