registry / @hasna/hooks / 0.3.1

@hasna/hooks@0.3.1

Open source hooks library for AI coding agents - Install safety, quality, and automation hooks with a single command

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 75 file(s), 868 KB of source, external domains: console.anthropic.com, ntfy.sh, registry.npmjs.org

Source & flagged code

6 flagged

package.jsonView file

Lines 12-52json

12 "import": "./dist/index.js"

13 },

14 "./storage": {

15 "types": "./dist/storage.d.ts",

16 "import": "./dist/storage.js"

17 }

18 },

19 "main": "./dist/index.js",

20 "types": "./dist/index.d.ts",

21 "scripts": {

22 "build": "rm -rf dist && bun build ./src/cli/index.tsx --outdir ./bin --target bun --external pg --external ink --external react --external chalk --external conf --external @modelcontextprotocol/sdk --external zod && bun build ./src/index.ts ./src/storage.ts --outdir ./dist --target bun --external pg && bun run build:types",

23 "build:types": "tsc -p tsconfig.build.json",

24 "dev": "bun run ./src/cli/index.tsx",

25 "test": "bun test",

26 "typecheck": "tsc --noEmit",

27 "validate:package": "bun run build && bun scripts/validate-package.ts",

28 "prepublishOnly": "bun run validate:package",

29 "dashboard:dev": "cd dashboard && bun run dev",

30 "dashboard:build": "cd dashboard && bun run build",

31 "dashboard:preview": "cd dashboard && bun run preview",

32 "postinstall": "mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "keywords": [

35 "claude-code",

36 "hooks",

37 "cli",

38 "typescript",

39 "bun",

40 "git-safety",

41 "code-quality",

42 "security"

43 ],

44 "author": "Hasna",

45 "license": "Apache-2.0",

46 "devDependencies": {

47 "@types/bun": "latest",

48 "@types/pg": "^8.15.6",

49 "@types/react": "^18.2.0",

50 "typescript": "^5"

51 },

52 "dependencies": {

bin/index.jsView file

Lines 32-72javascript

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(

hooks/hook-autoformat/src/hook.tsView file

Lines 1-28typescript

1#!/usr/bin/env bun

3/**

4 * Claude Code Hook: autoformat

5 *

6 * PostToolUse hook that auto-runs the project's formatter after file edits.

7 * Detects the formatter from project config files:

8 *

9 * - .prettierrc / prettier in package.json → bunx prettier --write <file>

10 * - biome.json → bunx biome format --write <file>

11 * - pyproject.toml with [tool.ruff] or [tool.black] → ruff format / black

12 * - .clang-format → clang-format -i <file>

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/index.jsView file

628var EventEmitter = __require("events").EventEmitter; L629: var childProcess = __require("child_process"); L630: var path = __require("path");

High

Child Process

Package source references child process execution.

bin/index.jsView on unpkg · L628

1070} L1071: const execArgv = process2.execArgv ?? []; L1072: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

bin/index.jsView on unpkg · L1070

52Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L52: class CommanderError extends Error { L53: constructor(exitCode, code, message) { L54: super(message); ... L628: var EventEmitter = __require("events").EventEmitter; L629: var childProcess = __require("child_process"); L630: var path = __require("path"); ... L673: this._outputConfiguration = { L674: writeOut: (str) => process2.stdout.write(str), L675: writeErr: (str) => process2.stderr.write(str), ... L4068: return codewithConfigPath; L4069: if (target === "codewith" && process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH) { L4070: return process.env.HASNA_HOOKS_CODEWITH_CONFIG_PATH;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/index.jsView on unpkg · L52

hooks/hook-autoformat/src/hook.tsView file

8* L9: * - .prettierrc / prettier in package.json → bunx prettier --write <file> L10: * - biome.json → bunx biome format --write <file> ... L17: import { join, extname } from "path"; L18: import { execSync } from "child_process"; L19:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/hook-autoformat/src/hook.tsView on unpkg · L8

Findings

5 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/index.js

HighShellbin/index.js

HighEntrypoint Build Divergencebin/index.js

HighRuntime Package Installhooks/hook-autoformat/src/hook.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 12-52json

12 "import": "./dist/index.js"

13 },

14 "./storage": {

15 "types": "./dist/storage.d.ts",

16 "import": "./dist/storage.js"

17 }

18 },

19 "main": "./dist/index.js",

20 "types": "./dist/index.d.ts",

21 "scripts": {

23 "build:types": "tsc -p tsconfig.build.json",

24 "dev": "bun run ./src/cli/index.tsx",

25 "test": "bun test",

26 "typecheck": "tsc --noEmit",

27 "validate:package": "bun run build && bun scripts/validate-package.ts",

28 "prepublishOnly": "bun run validate:package",

29 "dashboard:dev": "cd dashboard && bun run dev",

30 "dashboard:build": "cd dashboard && bun run build",

31 "dashboard:preview": "cd dashboard && bun run preview",

32 "postinstall": "mkdir -p $HOME/.hasna/hooks/profiles 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L32

33 },

34 "keywords": [

35 "claude-code",

36 "hooks",

37 "cli",

38 "typescript",

39 "bun",

40 "git-safety",

41 "code-quality",

42 "security"

43 ],

44 "author": "Hasna",

45 "license": "Apache-2.0",

46 "devDependencies": {

47 "@types/bun": "latest",

48 "@types/pg": "^8.15.6",

49 "@types/react": "^18.2.0",

50 "typescript": "^5"

51 },

52 "dependencies": {

bin/index.jsView file

Lines 32-72javascript

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(

hooks/hook-autoformat/src/hook.tsView file

Lines 1-28typescript

1#!/usr/bin/env bun

3/**

4 * Claude Code Hook: autoformat

5 *

6 * PostToolUse hook that auto-runs the project's formatter after file edits.

7 * Detects the formatter from project config files:

8 *

9 * - .prettierrc / prettier in package.json → bunx prettier --write <file>

10 * - biome.json → bunx biome format --write <file>

11 * - pyproject.toml with [tool.ruff] or [tool.black] → ruff format / black

12 * - .clang-format → clang-format -i <file>

Lines 1050-1090javascript

1050 getOptionValueSource(key) {

1051 return this._optionValueSources[key];

1052 }

1053 getOptionValueSourceWithGlobals(key) {

1054 let source;

1055 this._getCommandAndAncestors().forEach((cmd) => {

1056 if (cmd.getOptionValueSource(key) !== undefined) {

1057 source = cmd.getOptionValueSource(key);

1058 }

1059 });

1060 return source;

1061 }

1062 _prepareUserArgs(argv, parseOptions) {

1063 if (argv !== undefined && !Array.isArray(argv)) {

1064 throw new Error("first parameter to parse must be array or undefined");

1065 }

1066 parseOptions = parseOptions || {};

1067 if (argv === undefined && parseOptions.from === undefined) {

1068 if (process2.versions?.electron) {

1069 parseOptions.from = "electron";

1070 }

1071 const execArgv = process2.execArgv ?? [];

1072 if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

bin/index.jsView on unpkg · L1070

1073 parseOptions.from = "eval";

1074 }

1075 }

1076 if (argv === undefined) {

1077 argv = process2.argv;

1078 }

1079 this.rawArgs = argv.slice();

1080 let userArgs;

1081 switch (parseOptions.from) {

1082 case undefined:

1083 case "node":

1084 this._scriptPath = argv[1];

1085 userArgs = argv.slice(2);

1086 break;

1087 case "electron":

1088 if (process2.defaultApp) {

1089 this._scriptPath = argv[1];

1090 userArgs = argv.slice(2);