registry / @blazeinstall/hyperglob / 0.4.2

@blazeinstall/hyperglob@0.4.2

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The lifecycle network access is used to obtain this package’s platform-specific native binding from its project release endpoint. Inspected MCP operations perform client-requested local searches, with no source evidence of credential collection, unrelated data transfer, or other concrete attack behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

The download runs during npm postinstall when the platform binding is absent; MCP searches run when a client calls a search tool.

Impact

The observed behavior installs the package’s native component and responds to client-requested searches; no concrete attack impact was established.

Mechanism

The installer selects a platform-specific filename and downloads the corresponding release asset. The MCP server dispatches client queries to the package’s local search API.

AI rationale

Evidence

package.jsonscripts/install.jsmcp.js

Network endpoints1

github.com/Nom-nom-hub/hyperglob/releases/latest/download/${file}

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json runs scripts/install.js after installation.
The installer checks for a platform-specific native binding and downloads it from this package’s GitHub Releases URL.
The MCP runtime returns results from file-search operations, including paths and metadata.
The dependent-file operation returns the local query result.

Evidence against

Behavioral surface

Source

DynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 20.0 KB of source, external domains: github.com

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

57"postinstall": "node scripts/install.js" }, "types": "index.d.ts", "version": "0.4.2" }

Low

Ai Review Evidence

package.json runs scripts/install.js after installation.

package.jsonView on unpkg · L57

index.jsView file

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

scripts/install.jsView file

18const url = `https://github.com/Nom-nom-[redacted]/${file}`; console.log('hyperglob: downloading prebuilt binary for ' + process.platform + '-' + process.arch + '...'); const f = fs.createWrit

Low

Ai Review Evidence

The installer checks for a platform-specific native binding and downloads it from this package’s GitHub Releases URL.

scripts/install.jsView on unpkg · L18

16const dest = path.join(__dirname, '..', file); if (fs.existsSync(dest)) { process.exit(0); } const url = `https://github.com/Nom-nom-[redacted]/${file}`; console.log('hyperglob: downloading prebuilt bin

Low

Ai Review Evidence

The installer checks for a platform-specific native binding and downloads it from this package’s GitHub Releases URL.

scripts/install.jsView on unpkg · L16

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

57"postinstall": "node scripts/install.js" }, "types": "index.d.ts", "version": "0.4.2" }

Low

Ai Review Evidence

package.json runs scripts/install.js after installation.

package.jsonView on unpkg · L57

index.jsView file

2L3: const fs = require('fs'); L4: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

scripts/install.jsView file

18const url = `https://github.com/Nom-nom-[redacted]/${file}`; console.log('hyperglob: downloading prebuilt binary for ' + process.platform + '-' + process.arch + '...'); const f = fs.createWrit

Low

Ai Review Evidence

The installer checks for a platform-specific native binding and downloads it from this package’s GitHub Releases URL.

scripts/install.jsView on unpkg · L18

Low

Ai Review Evidence

The installer checks for a platform-specific native binding and downloads it from this package’s GitHub Releases URL.

scripts/install.jsView on unpkg · L16

Findings

1 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencescripts/install.js

Affected versions and remediation

This report applies to @blazeinstall/hyperglob@0.4.2.

See all versions of @blazeinstall/hyperglob for other recorded verdicts.

Review the evidence and your use of @blazeinstall/hyperglob@0.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 21:15:31.263Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.