your-ai-workflow-firebase-os@2.0.6: Malicious npm security report | LPM Firewall

Loading npm security reports…

your-ai-workflow-firebase-os@2.0.6: Malicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/unlink-BVIiMTx_.cjsView file

1require(`./chunk-CiTBaPhY.cjs`);var e={name:`unlink`,size:24,node:[[`path`,{d:`m18.84 12.25 1.72-1.71h-.02a5.004 5.004 0 0 0-.12-7.07 5.006 5.006 0 0 0-6.95 0l-1.72 1.71`,key:`yqzx...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unlink-BVIiMTx_.cjsView on unpkg · L1

scripts/postinstall.jsView file

17* L18: * It does NOT write GEMINI.md / AGENTS.md any more: AI Studio reserves those L19: * filenames for the developer's own instructions, and a package writing them ... L114: if (current.includes(CLEARED_MARKER)) continue; L115: fs.writeFileSync(filePath, `/* ${CLEARED_MARKER} postinstall */\n`); L116: console.log(` ✓ Cleared ${file} (was conflicting with your-ai-workflow-firebase-os styles)`); ... L149: const mainPath = path.join(srcDir, 'main.tsx'); L150: fs.writeFileSync(mainPath, withBanner(canonical ? canonical.main : FALLBACK_MAIN_TSX)); L151: console.log(' ✓ Wrote main.tsx (owned by Your AI Firebase — the build discards edits to it)'); ... L154: const fbosDir = path.join(srcDir, 'your-ai-workflow-firebase-os'); L155: if (!fs.existsSync(fbosDir)) fs.mkdirSync(fbosDir, { recur

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L17

dist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 39-79json

39 "server.template.ts",

40 "scripts/postinstall.js",

41 "scripts/patchViteConfig.js",

42 "src/index.css",

43 "src/pages/Home.tsx",

44 "src/microcomponents/registry.ts",

45 "src/configs/theme.config.ts",

46 "src/configs/forms/registry.ts",

47 "src/configs/forms/contactForm.config.ts",

48 "src/configs/forms/supportForm.config.ts",

49 "src/configs/pages/registry.ts"

50 ],

51 "scripts": {

52 "dev": "vite",

53 "test": "vitest run",

54 "test:watch": "vitest",

55 "build": "tsc -b && vite build",

56 "build:lib": "node scripts/writePackageExports.js && vite build",

57 "lint": "eslint .",

58 "preview": "vite preview",

59 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "release": "npm version patch && npm run build:lib && npm pack",

61 "verify:dist": "node scripts/verifyDist.js",

62 "prepack": "node scripts/verifyDist.js",

63 "postinstall:content": "node scripts/dumpPostinstallContent.js"

64 },

65 "dependencies": {

66 "@eslint/js": "^9.39.4",

67 "@tailwindcss/vite": "^4.2.2",

68 "@types/node": "^24.12.0",

69 "@types/react": "^19.2.14",

70 "@types/react-dom": "^19.2.3",

71 "@vitejs/plugin-react": "^6.0.1",

72 "clsx": "^2.1.1",

73 "framer-motion": "^12.38.0",

74 "fuse.js": "^7.3.0",

75 "iconoir": "^7.11.0",

76 "iconoir-react": "^7.11.0",

77 "lucide-react": "^1.47.0",

78 "react-dropzone": "^15.0.0",

79 "react-international-phone": "^4.8.0",

dist/unlink-BVIiMTx_.cjsView file

Lines 1-1javascript

1require(`./chunk-CiTBaPhY.cjs`);var e={name:`unlink`,size:24,node:[[`path`,{d:`m18.84 12.25 1.72-1.71h-.02a5.004 5.004 0 0 0-.12-7.07 5.006 5.006 0 0 0-6.95 0l-1.72 1.71`,key:`yqzxt4`}],[`path`,{d:`m5.17 11.75-1.71 1.71a5.004 5.004 0 0 0 .12 7.07 5.006 5.006 0 0 0 6.95 0l1.71-1.71`,key:`4qinb0`}],[`line`,{x1:

scripts/postinstall.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * your-ai-workflow-firebase-os postinstall script

4 *

5 * Runs automatically after `npm install your-ai-workflow-firebase-os`.

6 * Patches the consumer project so that <FirebaseOS /> renders correctly

7 * out of the box — no manual cleanup required.

8 *

9 * What it does:

10 * 1. Clears src/index.css and src/App.css to remove Vite default styling

11

dist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/ScheduleAdmin-BFE06xj6.cjs#virtual:normalized:round1View on unpkg