@hashbrownai/bedrock@0.8.0
Amazon Bedrock provider for Hashbrown AI
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe package performs unconsented install-time disclosure of identifying installation and development-environment data to a publisher-selected endpoint. The automatic lifecycle trigger and constrained endpoint support blocking under the installation beacon policy.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installation runs the package’s postinstall lifecycle hook.
Impact
Installation discloses identifying installation and development-environment information to the package publisher’s endpoint without installer consent.
Mechanism
The hook gathers installation and environment data, then posts it as JSON to the default collector; only affirmative environment opt-outs disable collection.
Attack narrative
During installation, the postinstall hook automatically collects a persistent installation ID and package and environment details, then sends them to the fixed Hashbrown collector endpoint. Outside CI, the event can also include Git identity and repository details. The endpoint override accepts only loopback addresses, and collection proceeds unless an affirmative opt-out flag is set.
AI rationale
The package performs unconsented install-time disclosure of identifying installation and development-environment data to a publisher-selected endpoint. The automatic lifecycle trigger and constrained endpoint support blocking under the installation beacon policy.
Evidence
package.jsoninstall/postinstall.cjsinstall/collector.cjsinstall/policy.cjsinstall/identity.cjsinstall/git-context.cjs
Network endpoints1
hashbrown.dev/_/growth/collect/v1/install
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs install/postinstall.cjs automatically from its postinstall lifecycle hook, which activates collectInstall.
- The install collector sends an installation event to the fixed https://hashbrown.dev/_/growth/collect/v1/install endpoint; overrides are restricted to loopback hosts.
- The event includes a persistent per-user installation ID and package, OS, architecture, Node, and package-manager details. Outside CI it can also include Git identity and repository details; telemetry is disabled only by affirmative opt-out environment flags.
Evidence against
- The collector has a short timeout and does not follow redirects; these controls limit the request but do not prevent its default disclosure.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg37"postinstall": "node install/postinstall.cjs"
}
}
High
Suspicious Lifecycle Evidence
The package runs install/postinstall.cjs automatically from its postinstall lifecycle hook, which activates collectInstall.
package.jsonView on unpkg · L37•scripts.postinstall = node install/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall/git-context.cjsView file
Findings
6 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall/git-context.cjs
HighPrevious Version Dangerous Deltainstall/git-context.cjs
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidenceinstall/postinstall.cjs
HighSuspicious Lifecycle Evidenceinstall/postinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @hashbrownai/bedrock@0.8.0.
See all versions of @hashbrownai/bedrock for other recorded verdicts.
- Avoid installing @hashbrownai/bedrock@0.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.