@gethookmyapp/cli@0.14.27
HookMyApp CLI, No BS. Just go live.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe selectable local profile points at a fixed ngrok host, and the CLI sends login and authenticated API traffic, including access tokens, to the selected API URL. Because the package defaults to production and this requires choosing the local profile, the source supports a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user selects the local profile with `--env local` or `hookmyapp config set env local` and logs in or makes authenticated API requests.
Impact
The tunnel operator can receive login bootstrap codes and authenticated API credentials when this profile is used. The package defaults to production, so this path is not taken by default.
Mechanism
The local profile sets the API URL to the ngrok host; login posts its bootstrap code there, saves the returned access token, and authenticated calls send that token to the selected API URL.
AI rationale
The selectable local profile points at a fixed ngrok host, and the CLI sends login and authenticated API traffic, including access tokens, to the selected API URL. Because the package defaults to production and this requires choosing the local profile, the source supports a warning rather than a malicious verdict.
Evidence
dist/cli.js~/.config/hookmyapp/config.json~/.config/hookmyapp/credentials.json
Network endpoints1
uninked-robbi-boughless.ngrok-free.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The `local` profile sends API and app traffic to the fixed host `uninked-robbi-boughless.ngrok-free.dev`.
- Login exchanges its bootstrap code at the API URL selected by the environment, then saves the returned access token and persists that environment choice.
- Authenticated API requests send the access token as a Bearer token to the effective API URL.
Evidence against
- The package defaults to the production HookMyApp API; the ngrok endpoint is only in the `local` profile.
- The manifest has no install hook; its `prepublishOnly` script builds and runs tests.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
Source & flagged code
9 flaggeddist/cli.jsView file
48* Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process19.stdout.write(str),
L1256: writeErr: (str) => process19.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.jsView on unpkg · L4848Trigger-reachable chain: manifest.bin -> bin/hookmyapp.js -> dist/cli.js
L48: * Constructs the CommanderError class
L49: * @param {number} exitCode suggested exit code which could be used with process.exit
L50: * @param {string} code an id string representing the error
...
L1204: var EventEmitter = __require("node:events").EventEmitter;
L1205: var childProcess4 = __require("node:child_process");
L1206: var path3 = __require("node:path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process19.stdout.write(str),
L1256: writeErr: (str) => process19.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsFindings
2 Critical6 High4 Medium6 Low
CriticalCredential Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
HighChild Processdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
HighKnown Malware Source Similaritydist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @gethookmyapp/cli@0.14.27.
See all versions of @gethookmyapp/cli for other recorded verdicts.
- Review the evidence and your use of @gethookmyapp/cli@0.14.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.