@ev-ai/agent-hook@1.2.1: AI-agent capability abuse – flagged

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Source shows explicit user-command agent configuration mutation and later automatic refresh, which warrant a warning under the supplied policy. No automatic npm install mutation, credential theft, or concrete malicious chain was established.

Static reason

One or more suspicious static signals were detected.

Trigger

Running the install command, followed by configured agent events.

Impact

Agent configuration changes enable ongoing telemetry and execution of updated package hooks.

Mechanism

Merge hook commands into agent configuration, serialize telemetry to a configured collector, and launch eligible background refreshes.

AI rationale

Source shows explicit user-command agent configuration mutation and later automatic refresh, which warrant a warning under the supplied policy. No automatic npm install mutation, credential theft, or concrete malicious chain was established.

Evidence

dist/cli.mjsdist/hook.mjsdist/launcher.mjsdist/launcher-update.mjs.claude/settings.json.cursor/hooks.json.codex/hooks.json

Network endpoints2

hooks.ev-ai.airegistry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit install command merges telemetry hooks into Claude, Cursor, and Codex configuration.
The CLI activates configuration changes through the user-invoked install command.
The hook builds telemetry for a configured collector; the indicated agent location identifies configuration roots.
The launcher can start a detached refresh after an eligible session start.
Refresh code restricts package archives to this package on registry.npmjs.org.

Evidence against

package.json has no npm lifecycle scripts or runtime self-dependency.
The indicated agent locations classify paths rather than modify configuration.
Inspected identity code extracts account identity rather than forwarding authentication tokens.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Source & flagged code

7 flagged

dist/launcher.mjsView file

2L3: import{spawn as Bn}from"node:child_process";import{homedir as jn}from"node:os";import{fileURLToPath as Rt}from"node:url";import{createHash as zt}from"node:crypto";import{join as K}... L4: `)}catch{}return 1}if(n==="bundled_cli")return(await wt(t)).main(e);if(n==="refresh"||n==="status")try{let i=await t.readPackageInfo().catch(()=>At),s=await ve(t);return s?n==="ref...

High

Child Process

Package source references child process execution.

dist/launcher.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/launcher.mjs spawns dist/cli.mjs; helper contains network access plus dynamic code execution. L2: L3: import{spawn as Bn}from"node:child_process";import{homedir as jn}from"node:os";import{fileURLToPath as Rt}from"node:url";import{createHash as zt}from"node:crypto";import{join as K}... L4: `)}catch{}return 1}if(n==="bundled_cli")return(await wt(t)).main(e);if(n==="refresh"||n==="status")try{let i=await t.readPackageInfo().catch(()=>At),s=await ve(t);return s?n==="ref...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/launcher.mjsView on unpkg · L2

2L3: import{spawn as Bn}from"node:child_process";import{homedir as jn}from"node:os";import{fileURLToPath as Rt}from"node:url";import{createHash as zt}from"node:crypto";import{join as K}... L4: `)}catch{}return 1}if(n==="bundled_cli")return(await wt(t)).main(e);if(n==="refresh"||n==="status")try{let i=await t.readPackageInfo().catch(()=>At),s=await ve(t);return s?n==="ref...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/launcher.mjsView on unpkg · L2

dist/hook.mjsView file

12`)}function ld(e){return jn(e)!==e}});var Me=he(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.redactComponentSource=f.prepareComponentInspectionText=f.fitSnap... L13: `)}function Z(e,t){Cc(Zr(e),{recursive:!0});let n=Qr(Zr(e),`.${Pc(e)}.${process.pid}.${Rc(4).toString("hex")}.tmp`);try{Oc(n,t,"utf8");try{Jr(n,e)}catch(r){let o=r instanceof Error... L14: `)}catch(s){let i=s instanceof Error?s.message:String(s);h(`WARN: operator identity cache write failed open: ${i}`)}}function Ko(e,t=Date.now()){if(!e)return!0;if(Se(e)?.operator_i...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hook.mjsView on unpkg · L12

11`),n=!1;return t.map(o=>n?Rs.test(o)?(n=!1,o):o.trim().length===0?o:T.COMPONENT_SOURCE_REDACTION_PLACEHOLDER:cd.test(o)&&!Rs.test(o)?(n=!0,o):ud(o)).join(` L12: `)}function ld(e){return jn(e)!==e}});var Me=he(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.redactComponentSource=f.prepareComponentInspectionText=f.fitSnap... L13: `)}function Z(e,t){Cc(Zr(e),{recursive:!0});let n=Qr(Zr(e),`.${Pc(e)}.${process.pid}.${Rc(4).toString("hex")}.tmp`);try{Oc(n,t,"utf8");try{Jr(n,e)}catch(r){let o=r instanceof Error... L14: `)}catch(s){let i=s instanceof Error?s.message:String(s);h(`WARN: operator identity cache write failed open: ${i}`)}}function Ko(e,t=Date.now()){if(!e)return!0;if(Se(e)?.operator_i...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/hook.mjsView on unpkg · L11

9`):u.join(` L10: `).trimEnd();return(0,J.usableCatalogText)(m)}});var As=he(T=>{"use strict";Object.defineProperty(T,"__esModule",{value:!0});T.SNAPSHOT_INSPECTION_TEXT_MAX_BYTES=T.COMPONENT_INSPEC... L11: `),n=!1;return t.map(o=>n?Rs.test(o)?(n=!1,o):o.trim().length===0?o:T.COMPONENT_SOURCE_REDACTION_PLACEHOLDER:cd.test(o)&&!Rs.test(o)?(n=!0,o):ud(o)).join(` L12: `)}function ld(e){return jn(e)!==e}});var Me=he(f=>{"use strict";Object.defineProperty(f,"__esModule",{value:!0});f.redactComponentSource=f.prepareComponentInspectionText=f.fitSnap... L13: `)}function Z(e,t){Cc(Zr(e),{recursive:!0});let n=Qr(Zr(e),`.${Pc(e)}.${process.pid}.${Rc(4).toString("hex")}.tmp`);try{Oc(n,t,"utf8");try{Jr(n,e)}catch(r){let o=r instanceof Error... L14: `)}catch(s){let i=s instanceof Error?s.message:Stri

Source & flagged code

7 flagged · loading source

dist/launcher.mjsView file

2L3: import{spawn as Bn}from"node:child_process";import{homedir as jn}from"node:os";import{fileURLToPath as Rt}from"node:url";import{createHash as zt}from"node:crypto";import{join as K}... L4: `)}catch{}return 1}if(n==="bundled_cli")return(await wt(t)).main(e);if(n==="refresh"||n==="status")try{let i=await t.readPackageInfo().catch(()=>At),s=await ve(t);return s?n==="ref...

High

Child Process

Package source references child process execution.

dist/launcher.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/launcher.mjs spawns dist/cli.mjs; helper contains network access plus dynamic code execution. L2: L3: import{spawn as Bn}from"node:child_process";import{homedir as jn}from"node:os";import{fileURLToPath as Rt}from"node:url";import{createHash as zt}from"node:crypto";import{join as K}... L4: `)}catch{}return 1}if(n==="bundled_cli")return(await wt(t)).main(e);if(n==="refresh"||n==="status")try{let i=await t.readPackageInfo().catch(()=>At),s=await ve(t);return s?n==="ref...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/launcher.mjsView on unpkg · L2

2L3: import{spawn as Bn}from"node:child_process";import{homedir as jn}from"node:os";import{fileURLToPath as Rt}from"node:url";import{createHash as zt}from"node:crypto";import{join as K}... L4: `)}catch{}return 1}if(n==="bundled_cli")return(await wt(t)).main(e);if(n==="refresh"||n==="status")try{let i=await t.readPackageInfo().catch(()=>At),s=await ve(t);return s?n==="ref...

Findings

6 High4 Medium4 Low

HighChild Processdist/launcher.mjs

HighSame File Env Network Executiondist/hook.mjs

HighCommand Output Exfiltrationdist/hook.mjs

HighSandbox Evasion Gated Capabilitydist/hook.mjs

HighCloud Metadata Accessdist/hook.mjs

HighCross File Remote Execution Contextdist/launcher.mjs

MediumDynamic Requiredist/launcher.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code