registry / @hasna/hooks / 0.3.7

@hasna/hooks@0.3.7

Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This is an AI-agent hook manager with explicit commands/MCP tools to register hooks into agent settings and run hook scripts. Risk is lifecycle/control-surface extension, but activation is user-invoked rather than npm install-time hijack.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall creates package state; `hooks install`, MCP `hooks_install`, or selected hook execution activates broader behavior.

Impact

Can add package-owned hook commands to Claude/Gemini settings and run hooks that inspect commands, log events, format files, or send configured notifications.

Mechanism

first-party agent hook registration and user-configured hook execution

Rationale

Source inspection confirms risky agent-hook capabilities are package-aligned and user-invoked, while npm postinstall only creates a package-owned profile directory. No concrete malicious chain such as credential exfiltration, remote payload execution, or stealth agent hijack was found.

Evidence

package.jsonbin/index.jsdist/index.jsdist/storage.jshooks/hook-knowledge-context/src/hook.tshooks/hook-autoformat/src/hook.tshooks/hook-slacknotify/src/hook.tshooks/hook-phonenotify/src/hook.tshooks/hook-packageage/src/hook.tshooks/hook-agentmessages/src/install.ts$HOME/.hasna/hooks/profiles$HOME/.hasna/hooks/hooks.db$HOME/.claude/settings.json.claude/settings.json$HOME/.gemini/settings.json.gemini/settings.jsonexplicit Codewith config path

Network endpoints2

registry.npmjs.orgntfy.sh

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json has postinstall lifecycle script creating $HOME/.hasna/hooks/profiles.
bin/index.js explicit `hooks install` writes Claude/Gemini hook commands into settings.json.
bin/index.js exposes MCP tools that can install/update/disable hooks and run hook scripts.
hooks include user-configured outbound notification/storage features and hook event logging.

Evidence against

postinstall only runs mkdir for package-owned profile directory; no agent settings mutation at npm install time.
Codewith install is fragment-only by default and direct write requires explicit --codewith-config path.
Network use is package-aligned: npm registry checks, user-configured webhooks/ntfy, and env-configured PostgreSQL.
No hardcoded credential theft, stealth persistence, remote payload download/execute, or destructive install behavior found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 75 file(s), 882 KB of source, external domains: console.anthropic.com, example.test, ntfy.sh, registry.npmjs.org

Source & flagged code

7 flagged

package.jsonView file

Lines 12-52json

12 "import": "./dist/index.js"

13 },

14 "./storage": {

15 "types": "./dist/storage.d.ts",

16 "import": "./dist/storage.js"

17 }

18 },

19 "main": "./dist/index.js",

20 "types": "./dist/index.d.ts",

21 "scripts": {

22 "build": "rm -rf dist && bun build ./src/cli/index.tsx --outdir ./bin --target bun --external pg --external ink --external react --external chalk --external conf --external @modelcontextprotocol/sdk --external zod && bun build ./src/index.ts ./src/storage.ts --outdir ./dist --target bun --external pg && bun run build:types",

23 "build:types": "tsc -p tsconfig.build.json",

24 "dev": "bun run ./src/cli/index.tsx",

25 "test": "bun test",

26 "typecheck": "tsc --noEmit",

27 "validate:package": "bun run build && bun scripts/validate-package.ts",

28 "prepublishOnly": "bun run validate:package",

29 "dashboard:dev": "cd dashboard && bun run dev",

30 "dashboard:build": "cd dashboard && bun run build",

31 "dashboard:preview": "cd dashboard && bun run preview",

32 "postinstall": "mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "keywords": [

35 "claude-code",

36 "hooks",

37 "cli",

38 "typescript",

39 "bun",

40 "git-safety",

41 "code-quality",

42 "security"

43 ],

44 "author": "Hasna",

45 "license": "Apache-2.0",

46 "devDependencies": {

47 "@types/bun": "latest",

48 "@types/pg": "^8.15.6",

49 "@types/react": "^18.2.0",

50 "typescript": "^5"

51 },

52 "dependencies": {

bin/index.jsView file

Lines 32-72javascript

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(

hooks/hook-autoformat/src/hook.tsView file

Lines 1-28typescript

1#!/usr/bin/env bun

3/**

4 * Claude Code Hook: autoformat

5 *

6 * PostToolUse hook that auto-runs the project's formatter after file edits.

7 * Detects the formatter from project config files:

8 *

9 * - .prettierrc / prettier in package.json → bunx prettier --write <file>

10 * - biome.json → bunx biome format --write <file>

11 * - pyproject.toml with [tool.ruff] or [tool.black] → ruff format / black

12 * - .clang-format → clang-format -i <file>

hooks/hook-knowledge-context/src/hook.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hasna/hooks@0.3.4 matchedIdentity = npm:QGhhc25hL2hvb2tz:0.3.4 similarity = 0.973 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/hook-knowledge-context/src/hook.tsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/index.jsView file

628var EventEmitter = __require("events").EventEmitter; L629: var childProcess = __require("child_process"); L630: var path = __require("path");

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L628

1070} L1071: const execArgv = process2.execArgv ?? []; L1072: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

bin/index.jsView on unpkg · L1070

52Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L52: class CommanderError extends Error { L53: constructor(exitCode, code, message) { L54: super(message); ... L628: var EventEmitter = __require("events").EventEmitter; L629: var childProcess = __require("child_process"); L630: var path = __require("path"); ... L673: this._outputConfiguration = { L674: writeOut: (str) => process2.stdout.write(str), L675: writeErr: (str) => process2.stderr.write(str), ... L4068: return codewithConfigPath; L4069: if (target === "codewith" && process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH) { L4070: return process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/index.jsView on unpkg · L52

hooks/hook-autoformat/src/hook.tsView file

8* L9: * - .prettierrc / prettier in package.json → bunx prettier --write <file> L10: * - biome.json → bunx biome format --write <file> ... L17: import { join, extname } from "path"; L18: import { execSync } from "child_process"; L19:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/hook-autoformat/src/hook.tsView on unpkg · L8

hooks/hook-knowledge-context/src/hook.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/hook-knowledge-context/src/hook.tsView on unpkg

Findings

1 Critical5 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltahooks/hook-knowledge-context/src/hook.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/index.js

HighShellbin/index.js

HighEntrypoint Build Divergencebin/index.js

HighRuntime Package Installhooks/hook-autoformat/src/hook.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

package.jsonView file

Lines 12-52json

12 "import": "./dist/index.js"

13 },

14 "./storage": {

15 "types": "./dist/storage.d.ts",

16 "import": "./dist/storage.js"

17 }

18 },

19 "main": "./dist/index.js",

20 "types": "./dist/index.d.ts",

21 "scripts": {

23 "build:types": "tsc -p tsconfig.build.json",

24 "dev": "bun run ./src/cli/index.tsx",

25 "test": "bun test",

26 "typecheck": "tsc --noEmit",

27 "validate:package": "bun run build && bun scripts/validate-package.ts",

28 "prepublishOnly": "bun run validate:package",

29 "dashboard:dev": "cd dashboard && bun run dev",

30 "dashboard:build": "cd dashboard && bun run build",

31 "dashboard:preview": "cd dashboard && bun run preview",

32 "postinstall": "mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "keywords": [

35 "claude-code",

36 "hooks",

37 "cli",

38 "typescript",

39 "bun",

40 "git-safety",

41 "code-quality",

42 "security"

43 ],

44 "author": "Hasna",

45 "license": "Apache-2.0",

46 "devDependencies": {

47 "@types/bun": "latest",

48 "@types/pg": "^8.15.6",

49 "@types/react": "^18.2.0",

50 "typescript": "^5"

51 },

52 "dependencies": {

bin/index.jsView file

Lines 32-72javascript

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(

hooks/hook-autoformat/src/hook.tsView file

Lines 1-28typescript

1#!/usr/bin/env bun

3/**

4 * Claude Code Hook: autoformat

5 *

6 * PostToolUse hook that auto-runs the project's formatter after file edits.

7 * Detects the formatter from project config files:

8 *

9 * - .prettierrc / prettier in package.json → bunx prettier --write <file>

10 * - biome.json → bunx biome format --write <file>

11 * - pyproject.toml with [tool.ruff] or [tool.black] → ruff format / black

12 * - .clang-format → clang-format -i <file>

hooks/hook-knowledge-context/src/hook.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hooks/hook-knowledge-context/src/hook.tsView on unpkg