@hashbrownai/anthropic@0.8.1
Anthropic provider for Hashbrown AI
AI Security Review
scanned 11d ago · by lpm-firewall-aiSource confirms automatic postinstall disclosure of identifying installation and environment data to a publisher-selected endpoint, with no affirmative consent gate. This is a concrete install-time attack surface and warrants blocking publication.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installing the package with lifecycle scripts enabled, unless telemetry is disabled or debug mode is enabled.
Impact
The publisher receives installation identifiers and environment details, potentially including the installer’s saved Git name and email, without affirmative installer consent.
Mechanism
The collector builds an installation event, may add saved Git identity and repository context, then sends it to the fixed Hashbrown collection endpoint. The endpoint override accepts only loopback hosts.
Attack narrative
A package install triggers a postinstall collector. Unless the installer has set an opt-out or debug flag, the collector sends installation and environment details to the package publisher’s default endpoint. The payload may also include the installer’s saved Git name and email and consuming checkout context. The available endpoint override is restricted to loopback hosts, so it does not provide destination selection for ordinary telemetry.
AI rationale
Source confirms automatic postinstall disclosure of identifying installation and environment data to a publisher-selected endpoint, with no affirmative consent gate. This is a concrete install-time attack surface and warrants blocking publication.
Evidence
package.jsoninstall/postinstall.cjsinstall/collector.cjsinstall/policy.cjsinstall/identity.cjsinstall/git-context.cjs
Network endpoints1
hashbrown.dev/_/growth/collect/v1/install
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs a postinstall script that invokes the collector.
- The collector sends an automatic package-installed event with installation, package, host, runtime, and environment details to hashbrown.dev by default.
- The event can include saved global Git name and email, plus checkout repository details.
- The install collector sends the event unless telemetry is disabled or debug logging is enabled; only loopback endpoint overrides are accepted.
- The helper reuses a valid installation UUID from the user's ~/.hashbrown/installation-id file or creates a UUID and writes it to a temporary file.
Evidence against
- An opt-out is available through telemetry environment variables, and debug mode logs the event instead of sending it.
- The install event has a short deadline and does not fail installation if collection or transport fails.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg37"postinstall": "node install/postinstall.cjs"
}
High
Suspicious Lifecycle Evidence
package.json runs a postinstall script that invokes the collector.
package.jsonView on unpkg · L37•scripts.postinstall = node install/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall/git-context.cjsView file
Findings
6 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall/git-context.cjs
HighKnown Malware Source Similarityinstall/policy.cjs
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidenceinstall/postinstall.cjs
HighAi Review Evidenceinstall/collector.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @hashbrownai/anthropic@0.8.1.
See all versions of @hashbrownai/anthropic for other recorded verdicts.
- Avoid installing @hashbrownai/anthropic@0.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.