your-ai-workflow-firebase-os@2.0.13
Your AI Firebase — a complete Firebase-powered admin app in one React component.
AI Security Review
scanned 24d ago · by lpm-firewall-aiAutomatic broad consumer-project mutation warrants a warning because it can overwrite user work during installation. The inspected source does not meet the stated blocking threshold for malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its post-install lifecycle script.
Impact
Consumer project content and build configuration can be changed without a separate setup command.
Mechanism
The script clears consumer CSS, replaces application entry files, alters Vite configuration and dependencies, and may create a .env template.
AI rationale
Automatic broad consumer-project mutation warrants a warning because it can overwrite user work during installation. The inspected source does not meet the stated blocking threshold for malicious behavior.
Evidence
scripts/postinstall.jsscripts/patchViteConfig.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package declares an automatic post-install script.
- The installer overwrites existing consumer CSS files with a marker.
- The installer replaces the consumer App.tsx and modifies the Vite configuration during installation.
- The installer also changes consumer dependencies and creates an environment file template.
Evidence against
- No credential collection, command execution, or network exfiltration was identified in the inspected installer.
- The observed writes are tied to the package's application setup rather than an AI-agent control surface.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/PublishApp-BcVnci2y.cjsView file
1require(`./chunk-CiTBaPhY.cjs`);const e=require(`./PageTitle-ByxBmxNx.cjs`),t=require(`./Picture-CIpRravW.cjs`),n=require(`./DashboardNav-D720vB0P.cjs`),r=require(`./chevron-down-l...
L2: `),label:`Copy all four`})]}),(0,l.jsx)(`div`,{className:`px-3.5 py-2.5 flex flex-col gap-1`,children:y.map(e=>(0,l.jsx)(`span`,{className:`text-[12.5px] font-mono text-foreground/...
Medium
Dynamic Require
Findings
1 Critical5 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/postinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/ThemeAdmin-BYrymThM.cjs#virtual:string-array:round1
HighKnown Malware Source Similaritydist/pageFiles-CjhtQ2a7.js
HighKnown Malware Source Similaritydist/mediaKind-BtaMpGy8.js
HighPrevious Version Dangerous Deltadist/server.cjs.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/PublishApp-BcVnci2y.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to your-ai-workflow-firebase-os@2.0.13.
See all versions of your-ai-workflow-firebase-os for other recorded verdicts.
- Review the evidence and your use of your-ai-workflow-firebase-os@2.0.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.