@hashbrownai/react@0.8.2
React components for Hashbrown AI
AI Security Review
scanned 4d ago · by lpm-firewall-aiThis is default install-time telemetry to the package publisher’s own service, and it can include identifying Git name and email. The evidence supports a telemetry warning rather than credential theft or another malicious attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the postinstall lifecycle hook unless telemetry is disabled.
Impact
Hashbrown receives installation telemetry that may identify the developer through Git name or email; this is an undisclosed-by-default install-time collection risk.
Mechanism
The hook gathers package and environment metadata, a persistent random installation ID, and optionally Git name, email and repository hints, then posts an event to the configured Hashbrown endpoint.
AI rationale
This is default install-time telemetry to the package publisher’s own service, and it can include identifying Git name and email. The evidence supports a telemetry warning rather than credential theft or another malicious attack.
Evidence
package.jsoninstall/postinstall.cjsinstall/collector.cjsinstall/git-context.cjsinstall/policy.cjsinstall/identity.cjs~/.hashbrown/installation-id
Network endpoints1
hashbrown.dev/_/growth/collect/v1/install
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs install/postinstall.cjs from its postinstall lifecycle script.
- The install collector sends a package.installed event with package, platform, runtime, package-manager and environment details to Hashbrown’s install endpoint.
- Outside CI, the event can include Git display name and email read from global or checkout configuration.
- The collector creates or reuses a persistent random installation ID, and supports telemetry opt-out environment variables.
Evidence against
- The endpoint belongs to the Hashbrown project, and the collector does not follow redirects or read the response.
- The collected data shown is installation telemetry; the inspected code does not show credential collection or transmission.
- The telemetry can be disabled with DO_NOT_TRACK, npm_config_do_not_track, NPM_CONFIG_DO_NOT_TRACK or HASHBROWN_TELEMETRY_DISABLED.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg62"scripts": {
"postinstall": "node install/postinstall.cjs"
}
}
Medium
Suspicious Lifecycle Evidence
The package runs install/postinstall.cjs from its postinstall lifecycle script.
package.jsonView on unpkg · L62install/git-context.cjsView file
Findings
3 High6 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall/git-context.cjs
HighKnown Malware Source Similarityinstall/policy.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceinstall/git-context.cjs
MediumAi Review Evidenceinstall/collector.cjs
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @hashbrownai/react@0.8.2.
See all versions of @hashbrownai/react for other recorded verdicts.
- Review the evidence and your use of @hashbrownai/react@0.8.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.