@hashbrownai/angular@0.8.1
Angular bindings for Hashbrown AI
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe active postinstall discloses persistent and Git identity data to a package-aligned telemetry endpoint unless users opt out. This is a concrete privacy risk, but the inspected source does not support a malicious verdict or publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package with its postinstall hook enabled and without a telemetry opt-out.
Impact
The vendor’s collector can receive identifying user and repository information during installation.
Mechanism
The collector reads or creates a per-user installation ID, gathers Git name and email plus checkout context, adds package and environment details, and posts the event to the configured endpoint.
AI rationale
The active postinstall discloses persistent and Git identity data to a package-aligned telemetry endpoint unless users opt out. This is a concrete privacy risk, but the inspected source does not support a malicious verdict or publish block.
Evidence
package.jsoninstall/postinstall.cjsinstall/collector.cjsinstall/identity.cjsinstall/git-context.cjsinstall/policy.cjs~/.hashbrown/installation-id
Network endpoints1
hashbrown.dev/_/growth/collect/v1/install
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs a postinstall hook that invokes the install collector.
- The collector gathers a persistent per-user installation ID and Git display name/email, then includes available identity and consumer context in the installation event.
- The event is sent automatically to hashbrown.dev unless a telemetry opt-out is set; the endpoint policy accepts only loopback overrides.
- The endpoint matches the package’s Hashbrown project identity, and the inspected code establishes no credential theft or unrelated recipient.
Evidence against
- The default telemetry destination is the package-aligned hashbrown.dev host, rather than an unrelated collector.
- Telemetry can be disabled with standard do-not-track variables or the package-specific opt-out.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg6"repository": {
"type": "git",
"url": "https://github.com/liveloveapp/hashbrown.git",
"directory": "packages/angular"
},
"peerDependencies": {
"@angular/core": "^22.0.0",
"@hashbrownai
Medium
Suspicious Lifecycle Evidence
The manifest runs a postinstall hook that invokes the install collector.
package.jsonView on unpkg · L6install/git-context.cjs
Findings
3 High6 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall/git-context.cjs
HighKnown Malware Source Similarityinstall/policy.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumSuspicious Lifecycle Evidenceinstall/postinstall.cjs
MediumAi Review Evidenceinstall/identity.cjs
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @hashbrownai/angular@0.8.1.
See all versions of @hashbrownai/angular for other recorded verdicts.
- Review the evidence and your use of @hashbrownai/angular@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.