registry / @hashbrownai/typesafe / 0.8.1
@hashbrownai/typesafe@0.8.1
TypeSafe Jev decision adapter for Hashbrown AI
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe install hook performs package-aligned telemetry with standard opt-outs, and the runtime API sends caller-provided credentials to the package’s TypeSafe service. The inspected source does not establish malicious behavior, so the package is clean.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The package manager runs the declared postinstall hook during installation.
Impact
This is package-aligned telemetry. The inspected source does not establish credential theft, remote code execution, or an unauthorized control-surface change.
Mechanism
The collector sends an installation event and may include Git identity outside CI; standard telemetry opt-outs are checked before collection.
AI rationale
The install hook performs package-aligned telemetry with standard opt-outs, and the runtime API sends caller-provided credentials to the package’s TypeSafe service. The inspected source does not establish malicious behavior, so the package is clean.
Network endpoints2
hashbrown.dev/_/growth/collect/v1/installapi.typesafe.ai
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a postinstall hook that runs the package’s install collector.
- The inspected tslib dependency is the TypeScript runtime library, and its entrypoint contains ordinary helper code.
- The collector honors telemetry opt-outs and sends package installation events to Hashbrown’s configured endpoint.
- Git display name and email may be included in telemetry outside CI; the runtime API sends the caller’s API key to TypeSafe for decision requests.
- The collector’s development bridge write is restricted to @hashbrownai/core, not this package.
- The runtime’s default service endpoint is api.typesafe.ai.
Evidence against
- Postinstall telemetry is automatic unless an opt-out is set, and may include a persistent installation identifier and Git identity outside CI.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg35"postinstall": "node install/postinstall.cjs"
}
}
Low
Suspicious Lifecycle Evidence
package.json defines a postinstall hook that runs the package’s install collector.
package.jsonView on unpkg · L35install/git-context.cjsView file
Findings
3 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall/git-context.cjs
HighKnown Malware Source Similarityinstall/policy.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-f3ebdada-df79-4ce4-8876-3b2dac7e889c/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-f3ebdada-df79-4ce4-8876-3b2dac7e889c/0/npm-linux/tslib.js
Affected versions and remediation
This report applies to @hashbrownai/typesafe@0.8.1.
See all versions of @hashbrownai/typesafe for other recorded verdicts.
- Review the evidence and your use of @hashbrownai/typesafe@0.8.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.