@blazeinstall/hyperglob@1.0.4
A multi-threaded, AST-aware, zero-copy file discovery engine designed to replace legacy globbing for AI agents, monorepos, and high-performance developer tooling.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest activates a hook that silently writes agent configuration and registers this package as an enabled MCP server. This is unconsented install-time mutation of an agent control surface, warranting a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package runs its postinstall hook.
Impact
Affected agent applications may launch the newly registered server, expanding their configured tool surface.
Mechanism
The hook writes an enabled hyperglob entry into agent configuration files when one is absent; the entry invokes this package's mcp.js with Node.
Policy narrative
During package installation, the postinstall hook adds an enabled MCP server entry to global or project agent settings without requesting consent. That entry launches this package's MCP server, expanding the tools available to configured agents.
AI rationale
The manifest activates a hook that silently writes agent configuration and registers this package as an enabled MCP server. This is unconsented install-time mutation of an agent control surface, warranting a publish block.
Evidence
package.jsonscripts/install.js~/.claude.json<cwd>/.mcp.json
Network endpoints1
github.com/Nom-nom-hub/hyperglob/releases/latest/download/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/install.js as a postinstall hook and declares the package as its own dependency.
- scripts/install.js writes changed configuration files without a consent prompt.
- The install hook adds an enabled hyperglob MCP server to global and project agent configurations when no entry already exists.
- The registered command launches this package's mcp.js through Node.
Evidence against
- The binary download targets the package’s GitHub release path; that endpoint alone does not establish malicious behavior.
- mcp.js implements file-discovery and import-dependency queries when an agent calls its tools.
Behavioral surface
DynamicRequireFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg57"postinstall": "node scripts/install.js"
},
"types": "index.d.ts",
"version": "1.0.4",
"dependencies": {
"@blazeinstall/hyperglob": "^1.0.2"
}
}
High
Suspicious Lifecycle Evidence
package.json runs scripts/install.js as a postinstall hook and declares the package as its own dependency.
package.jsonView on unpkg · L57•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgindex.jsView file
Findings
1 Critical3 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltascripts/install.js
HighSuspicious Lifecycle Evidencepackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requireindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @blazeinstall/hyperglob@1.0.4.
See all versions of @blazeinstall/hyperglob for other recorded verdicts.
- Avoid installing @blazeinstall/hyperglob@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.