your-ai-workflow-firebase-os@1.9.0
Your AI Firebase — a complete Firebase-powered admin app in one React component.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic broad rewrite of consumer source and build configuration warrants a warning. The inspected source does not establish the policy conditions for a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation of the package
Impact
Existing styling and application entry code can be discarded, and future builds load package-controlled plugin code.
Mechanism
Automatic postinstall consumer-project rewrite and build-plugin injection
AI rationale
The automatic broad rewrite of consumer source and build configuration warrants a warning. The inspected source does not establish the policy conditions for a publish block.
Evidence
package.jsonscripts/postinstall.jssrc/index.csssrc/App.csssrc/main.tsxsrc/your-ai-workflow-firebase-osvite.config.ts.env
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package runs its installer automatically through postinstall.
- The installer erases existing consumer CSS files during installation.
- The installer overwrites consumer entry code and injects its build plugin into Vite configuration.
Evidence against
- No install-time network request, shell execution, credential collection, or self-dependency was found.
- The runtime network code is for Firebase token validation, Firestore, and configured Resend email features.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/your-ai-workflow-firebase-os.cjs.jsView file
1Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`./chunk-DYteiM-1.cjs`),t=require(`./ContactPopup-Bwo6T2ID.cjs`),n=require(`./assetUpload-BBagvja...
L2: `),n=new Blob([`${e}\n${t}`],{type:`text/csv`}),r=window.URL.createObjectURL(n),i=document.createElement(`a`);i.href=r,i.download=`export_${Y.name||`table`}.csv`,i.click(),window.U...
Medium
Findings
1 Critical2 High5 Medium5 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/your-ai-workflow-firebase-os.css
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/your-ai-workflow-firebase-os.cjs.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to your-ai-workflow-firebase-os@1.9.0.
See all versions of your-ai-workflow-firebase-os for other recorded verdicts.
- Review the evidence and your use of your-ai-workflow-firebase-os@1.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.