your-ai-workflow-firebase-os@2.0.11
Your AI Firebase — a complete Firebase-powered admin app in one React component.
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe automatic, broad consumer-project mutation warrants a warning because it can overwrite user work during installation. Static inspection did not establish malware behavior or an exfiltration path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package with npm runs the postinstall lifecycle hook.
Impact
A consumer's existing application styling, entry files, dependencies, and build configuration can be changed without a separate setup command.
Mechanism
The hook clears CSS, overwrites application files, changes package.json dependencies, and patches vite.config.ts.
AI rationale
The automatic, broad consumer-project mutation warrants a warning because it can overwrite user work during installation. Static inspection did not establish malware behavior or an exfiltration path.
Evidence
scripts/postinstall.jssrc/index.csssrc/App.csssrc/App.tsxpackage.jsonvite.config.ts.env
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package runs scripts/postinstall.js automatically after installation.
- The postinstall hook overwrites consumer CSS files and writes an owned App.tsx.
- The hook adds Tailwind dependencies and modifies the consumer Vite configuration.
- The inspected schedule bundle uses Firebase Firestore for application data.
Evidence against
- No external HTTP endpoint, shell execution, credential harvesting, or self-dependency was found in the inspected paths.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/brick-wall-CVIm4aBt.cjsView file
1require(`./chunk-CiTBaPhY.cjs`);var e={name:`brick-wall`,size:24,node:[[`rect`,{width:`18`,height:`18`,x:`3`,y:`3`,rx:`2`,key:`afitv7`}],[`path`,{d:`M12 9v6`,key:`199k2o`}],[`path`...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/brick-wall-CVIm4aBt.cjsView on unpkg · L1Findings
1 Critical2 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/ScheduleAdmin-BUBN6MHw.cjs#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/brick-wall-CVIm4aBt.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to your-ai-workflow-firebase-os@2.0.11.
See all versions of your-ai-workflow-firebase-os for other recorded verdicts.
- Review the evidence and your use of your-ai-workflow-firebase-os@2.0.11 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.