Loading npm security reports…

@haus-tech/haus-workflow@5.10.0: AI-agent control-surface risk | LPM Firewall

registry / @haus-tech/haus-workflow / 5.10.0

@haus-tech/haus-workflow@5.10.0

Haus AI workflow CLI for Claude Code.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically runs haus install --postinstall, which writes Claude Code skills, hook commands, and security rules into the user Claude config and pins a third-party plugin. The user is not prompted; the only gates are global scope, absence of CI, and an opt-out environment variable.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during a global install of this package.

Impact

Claude Code tool use and stop events are hooked to this package, and a foreign always-on plugin is installed into the user agent config without an install-time consent prompt.

Mechanism

scripts/postinstall.mjs spawnSyncs dist/cli.js install --postinstall, which merges haus hooks into Claude settings.json and ensures the superpowers marketplace plugin.

Policy narrative

Installing this package globally runs its postinstall script, which launches the bundled CLI with install --postinstall. That command seeds the user Claude config with haus skills and agents, writes PreToolUse and Stop hooks that call haus, and pins the third-party superpowers plugin for always-on activation. There is no consent prompt; CI and HAUS_NO_POSTINSTALL only skip the write. This is unconsented mutation of the broad Claude agent control surface at install time.

AI rationale

The npm postinstall hook unconditionally starts a global Claude config write when the install is global, outside CI, and not opted out. That write changes ~/.claude settings and enables a third-party always-on plugin, which is an unconsented broad agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

21function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L21

21Trigger-reachable chain: manifest.bin -> dist/cli.js L21: function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.8.0 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:5.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

library/global/skills/request/scripts/svep.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.8.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/svep.mjsView on unpkg

library/global/skills/request/scripts/report.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.8.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/report.mjsView on unpkg

library/global/skills/request/scripts/korning.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @haus-tech/haus-workflow@5.7.0 matchedIdentity = npm:[redacted]:5.7.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

library/global/skills/request/scripts/korning.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 25-65json

25 "build": "rm -rf dist && esbuild src/cli.ts --bundle --packages=external --platform=node --format=esm --outdir=dist --external:@inquirer/checkbox",

26 "dev": "tsx src/cli.ts",

27 "test": "node scripts/test-fast.mjs",

28 "test:quick": "node scripts/test-fast.mjs --quick",

29 "test:full": "node scripts/run-tests.mjs tests/**/*.test.js",

30 "test:coverage": "c8 yarn test:full",

31 "coverage:check": "c8 --check-coverage yarn test:full",

32 "lint": "eslint src --cache --cache-location .eslintcache",

33 "format:check": "prettier --check --cache --cache-location .prettiercache .",

34 "format": "prettier --write --cache --cache-location .prettiercache .",

35 "typecheck": "tsc --noEmit",

36 "pack:local": "yarn pack",

37 "release": "GITHUB_TOKEN=$(gh auth token) LEFTHOOK_EXCLUDE=branch-guard release-it",

38 "release:dry": "GITHUB_TOKEN=$(gh auth token) LEFTHOOK_EXCLUDE=branch-guard release-it --dry-run",

39 "prepack": "yarn build",

40 "verify": "node scripts/verify.mjs",

41 "verify:full": "node scripts/verify.mjs --coverage",

42 "check:contract-behavior": "node --import tsx scripts/contract-behavior-check.mjs",

43 "check:mutation-table": "node scripts/check-mutation-table.mjs",

44 "check:docs-site": "node scripts/check-docs-site.mjs",

45 "postinstall": "node ./scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "prepare": "lefthook install || true",

47 "security:audit": "yarn npm audit -A -R --severity high --environment production"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "5.2.1",

51 "commander": "13.1.0",

52 "diff": "8.0.4",

53 "execa": "9.6.1",

54 "fast-glob": "3.3.3",

55 "fs-extra": "11.4.0",

56 "semver": "7.8.5",

57 "tar": "7.5.22",

58 "yaml": "2.9.0"

59 },

60 "devDependencies": {

61 "@release-it/conventional-changelog": "11.0.1",

62 "@types/fs-extra": "11.0.4",

63 "@types/node": "22.20.1",

64 "@types/semver": "7.8.0",

65 "@typescript-eslint/eslint-plugin": "8.69.0",

dist/cli.jsView file

21function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L21

21Trigger-reachable chain: manifest.bin -> dist/cli.js L21: function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.8.0 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:5.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

library/global/skills/request/scripts/svep.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.8.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/svep.mjsView on unpkg

library/global/skills/request/scripts/report.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.8.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/report.mjsView on unpkg

library/global/skills/request/scripts/korning.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @haus-tech/haus-workflow@5.7.0 matchedIdentity = npm:[redacted]:5.7.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

library/global/skills/request/scripts/korning.mjsView on unpkg