@gethookmyapp/cli@0.14.23
HookMyApp CLI, No BS. Just go live.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe CLI’s `local` profile routes authenticated API requests to a fixed ngrok host and persists that choice. Because the profile must be selected explicitly and production is the default, this is a serious but conditional credential-routing risk; the source does not establish who controls the tunnel.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user explicitly selects the `local` profile, for example with `config set env local`.
Impact
If the ngrok endpoint is not controlled by the legitimate HookMyApp service, its operator could receive the user’s credentials and API requests.
Mechanism
CLI API requests use the profile’s base URL and attach the stored access token as a Bearer token; the selected profile is persisted in configuration.
AI rationale
The CLI’s `local` profile routes authenticated API requests to a fixed ngrok host and persists that choice. Because the profile must be selected explicitly and production is the default, this is a serious but conditional credential-routing risk; the source does not establish who controls the tunnel.
Evidence
bin/hookmyapp.jsdist/cli.js~/.config/hookmyapp/config.json~/.config/hookmyapp/credentials.json
Network endpoints2
uninked-robbi-boughless.ngrok-free.devapi.hookmyapp.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The `hookmyapp` executable imports `dist/cli.js` when run.
- The bundled `local` profile points its API and app URLs to `uninked-robbi-boughless.ngrok-free.dev`.
- The API client reads stored credentials and sends the access token as a Bearer authorization header.
- The API client sends requests to the selected base URL.
- `config set env local` persists the environment choice for later CLI runs.
- The default environment is `production`.
Evidence against
- The ngrok endpoint is used only when the `local` profile is selected; production is the default.
- Selecting `local` requires an explicit configuration choice, though the profile’s remote endpoint is not apparent from its name.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/cli.jsView file
48* Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process19.stdout.write(str),
L1256: writeErr: (str) => process19.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4848Trigger-reachable chain: manifest.bin -> bin/hookmyapp.js -> dist/cli.js
L48: * Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process19.stdout.write(str),
L1256: writeErr: (str) => process19.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsFindings
2 Critical7 High3 Medium5 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
HighKnown Malware Source Similaritydist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @gethookmyapp/cli@0.14.23.
See all versions of @gethookmyapp/cli for other recorded verdicts.
- Review the evidence and your use of @gethookmyapp/cli@0.14.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.