@ev-ai/agent-hook@1.0.9: AI-agent capability abuse – flagged

AI Security Review

scanned 22d ago · by lpm-firewall-ai

The inspected source implements explicit user-command agent configuration mutation and telemetry delivery, which the supplied policy classifies as a warning. No npm lifecycle mutation or concrete malicious chain supports blocking publication.

Static reason

One or more suspicious static signals were detected.

Trigger

The user runs the CLI install command; subsequent agent events execute configured hooks.

Impact

Agent events can execute telemetry collection and transmit collected runtime information after setup.

Mechanism

The installer merges command hooks into agent configuration files, and the runtime posts telemetry to the selected collector.

AI rationale

The inspected source implements explicit user-command agent configuration mutation and telemetry delivery, which the supplied policy classifies as a warning. No npm lifecycle mutation or concrete malicious chain supports blocking publication.

Evidence

dist/cli.mjsdist/hook.mjs.claude/settings.json.cursor/hooks.json.codex/hooks.json.claude/ev-ai-runtime-report.json

Network endpoints1

hooks.ev-ai.ai

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json exposes a CLI and declares no npm lifecycle hooks or runtime self-dependency.
The explicit install command invokes agent hook configuration setup.
Setup writes command hooks into project Cursor and Codex configurations and also supports Claude.
dist/hook.mjs posts telemetry to the configured collector.

Evidence against

Configuration changes require an explicit CLI command; no automatic npm install mutation was found.
The indicated agent integration locations identify configuration roots rather than writing them.
No concrete malicious attack was established from the inspected behavior.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 174 KB of source, external domains: 169.254.169.254, cdn.ev-ai.ai, hooks.ev-ai.ai, metadata.google.internal

Source & flagged code

5 flagged

dist/hook.mjsView file

4var mo=Object.create;var Yt=Object.defineProperty;var go=Object.getOwnPropertyDescriptor;var _o=Object.getOwnPropertyNames;var ho=Object.getPrototypeOf,Eo=Object.prototype.hasOwnPr... L5: `)}function G(e,t){Co(Qt(e),{recursive:!0});let n=tn(Qt(e),`.${ko(e)}.${process.pid}.${yo(4).toString("hex")}.tmp`);try{Oo(n,t,"utf8");try{Zt(n,e)}catch(r){let o=r instanceof Error... L6: `)}catch(s){let a=s instanceof Error?s.message:String(s);_(`WARN: operator identity cache write failed open: ${a}`)}}function vn(e,t=Date.now()){if(!e)return!0;if(J(e)?.operator_id...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hook.mjsView on unpkg · L4

3L4: var mo=Object.create;var Yt=Object.defineProperty;var go=Object.getOwnPropertyDescriptor;var _o=Object.getOwnPropertyNames;var ho=Object.getPrototypeOf,Eo=Object.prototype.hasOwnPr... L5: `)}function G(e,t){Co(Qt(e),{recursive:!0});let n=tn(Qt(e),`.${ko(e)}.${process.pid}.${yo(4).toString("hex")}.tmp`);try{Oo(n,t,"utf8");try{Zt(n,e)}catch(r){let o=r instanceof Error... L6: `)}catch(s){let a=s instanceof Error?s.message:String(s);_(`WARN: operator identity cache write failed open: ${a}`)}}function vn(e,t=Date.now()){if(!e)return!0;if(J(e)?.operator_id...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook.mjsView on unpkg · L3

3L4: var mo=Object.create;var Yt=Object.defineProperty;var go=Object.getOwnPropertyDescriptor;var _o=Object.getOwnPropertyNames;var ho=Object.getPrototypeOf,Eo=Object.prototype.hasOwnPr... L5: `)}function G(e,t){Co(Qt(e),{recursive:!0});let n=tn(Qt(e),`.${ko(e)}.${process.pid}.${yo(4).toString("hex")}.tmp`);try{Oo(n,t,"utf8");try{Zt(n,e)}catch(r){let o=r instanceof Error... L6: `)}catch(s){let a=s instanceof Error?s.message:String(s);_(`WARN: operator identity cache write failed open: ${a}`)}}function vn(e,t=Date.now()){if(!e)return!0;if(J(e)?.operator_id... ... L9: `,{encoding:"utf8",flag:"wx"})}function gn(e,t){try{return fs(e,t),t}catch(n){if(!Un(n))throw n;return J(e)}}function _n(e,t){it(Ae(e),{recursive:!0}),G(e,`${JSON.stringify(t,null,... L10: `)}function hn(e,t){return{install

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/hook.mjsView on unpkg · L3

3L4: var mo=Object.create;var Yt=Object.defineProperty;var go=Object.getOwnPropertyDescriptor;var _o=Object.getOwnPropertyNames;var ho=Object.getPrototypeOf,Eo=Object.prototype.hasOwnPr... L5: `)}function G(e,t){Co(Qt(e),{recursive:!0});let n=tn(Qt(e),`.${ko(e)}.${process.pid}.${yo(4).toString("hex")}.tmp`);try{Oo(n,t,"utf8");try{Zt(n,e)}catch(r){let o=r instanceof Error... L6: `)}catch(s){let a=s instanceof Error?s.message:String(s);_(`WARN: operator identity cache write failed open: ${a}`)}}function vn(e,t=Date.now()){if(!e)return!0;if(J(e)?.operator_id... ... L9: `,{encoding:"utf8",flag:"wx"})}function gn(e,t){try{return fs(e,t),t}catch(n){if(!Un(n))throw n;return J(e)}}function _n(e,t){it(Ae(e),{recursive:!0}),G(e,`${JSON.stringify(t,null,... L10: `)}function hn(e,t){return{install

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/hook.mjsView on unpkg · L3

dist/cli.mjsView file

4Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli.mjs L4: L5: var ls=Object.create;var In=Object.defineProperty;var us=Object.getOwnPropertyDescriptor;var ds=Object.getOwnPropertyNames;var fs=Object.getPrototypeOf,ps=Object.prototype.hasOwnPr... L6: `)}function X(e,t){Cs(Dn(e),{recursive:!0});let n=$n(Dn(e),`.${xs(e)}.${process.pid}.${ks(4).toString("hex")}.tmp`);try{Os(n,t,"utf8");try{Mn(n,e)}catch(r){let o=r instanceof Error... L7: `)}catch(s){let a=s instanceof Error?s.message:String(s);d(`WARN: operator identity cache write failed open: ${a}`)}}function ir(e,t=Date.now()){if(!e)return!0;if(ne(e)?.operator_i...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.mjsView on unpkg · L4

Source & flagged code

5 flagged · loading source

dist/hook.mjsView file

4var mo=Object.create;var Yt=Object.defineProperty;var go=Object.getOwnPropertyDescriptor;var _o=Object.getOwnPropertyNames;var ho=Object.getPrototypeOf,Eo=Object.prototype.hasOwnPr... L5: `)}function G(e,t){Co(Qt(e),{recursive:!0});let n=tn(Qt(e),`.${ko(e)}.${process.pid}.${yo(4).toString("hex")}.tmp`);try{Oo(n,t,"utf8");try{Zt(n,e)}catch(r){let o=r instanceof Error... L6: `)}catch(s){let a=s instanceof Error?s.message:String(s);_(`WARN: operator identity cache write failed open: ${a}`)}}function vn(e,t=Date.now()){if(!e)return!0;if(J(e)?.operator_id...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hook.mjsView on unpkg · L4

3L4: var mo=Object.create;var Yt=Object.defineProperty;var go=Object.getOwnPropertyDescriptor;var _o=Object.getOwnPropertyNames;var ho=Object.getPrototypeOf,Eo=Object.prototype.hasOwnPr... L5: `)}function G(e,t){Co(Qt(e),{recursive:!0});let n=tn(Qt(e),`.${ko(e)}.${process.pid}.${yo(4).toString("hex")}.tmp`);try{Oo(n,t,"utf8");try{Zt(n,e)}catch(r){let o=r instanceof Error... L6: `)}catch(s){let a=s instanceof Error?s.message:String(s);_(`WARN: operator identity cache write failed open: ${a}`)}}function vn(e,t=Date.now()){if(!e)return!0;if(J(e)?.operator_id...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook.mjsView on unpkg · L3

Findings

5 High3 Medium4 Low

HighSame File Env Network Executiondist/hook.mjs

HighCommand Output Exfiltrationdist/hook.mjs

HighSandbox Evasion Gated Capabilitydist/hook.mjs

HighCloud Metadata Accessdist/hook.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code