@hashbrownai/angular@0.8.0
Angular bindings for Hashbrown AI
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource confirms default installation telemetry that can include persistent installation identity and configured Git email, with opt-outs but no affirmative-consent gate. The endpoint is package-aligned and the event is installation-related, so the evidence supports a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A package manager runs the package’s postinstall hook.
Impact
Installation metadata and potentially identifying Git details are disclosed to the package vendor without affirmative opt-in.
Mechanism
The hook collects installation and environment details, discovers Git identity, and sends the event to the default hashbrown.dev endpoint unless an opt-out is set.
AI rationale
Source confirms default installation telemetry that can include persistent installation identity and configured Git email, with opt-outs but no affirmative-consent gate. The endpoint is package-aligned and the event is installation-related, so the evidence supports a warning rather than a publish block.
Evidence
package.jsoninstall/postinstall.cjsinstall/collector.cjsinstall/policy.cjsinstall/git-context.cjs
Network endpoints1
hashbrown.dev/_/growth/collect/v1/install
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically invokes the install collector.
- The collector sends package installation events with a persistent installation identifier and package, platform, runtime, and environment details.
- The collector includes discovered Git identity, including a configured email, in non-CI events.
- The default recipient is hashbrown.dev; endpoint overrides are accepted only for loopback hosts.
- Collection is disabled only when a recognized opt-out variable is set.
Evidence against
- The telemetry endpoint is on the package vendor’s hashbrown.dev domain, and the event concerns package installation.
- The collector supports opt-out variables and avoids adding Git identity in CI.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg48"postinstall": "node install/postinstall.cjs"
}
}
Medium
Suspicious Lifecycle Evidence
The postinstall hook automatically invokes the install collector.
package.jsonView on unpkg · L48install/git-context.cjsView file
Findings
2 High7 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall/git-context.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidenceinstall/postinstall.cjs
MediumAi Review Evidenceinstall/collector.cjs
MediumAi Review Evidenceinstall/git-context.cjs
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @hashbrownai/angular@0.8.0.
See all versions of @hashbrownai/angular for other recorded verdicts.
- Review the evidence and your use of @hashbrownai/angular@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.