Loading npm security reports…

@haus-tech/haus-workflow@5.10.1: AI-agent control-surface risk | LPM Firewall

registry / @haus-tech/haus-workflow / 5.10.1

@haus-tech/haus-workflow@5.10.1

Haus AI workflow CLI for Claude Code.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically modifies the user's Claude Code control surface. It adds agent-related configuration and command hooks without an interactive consent step.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package globally through npm outside CI, unless the opt-out environment variable is already set.

Impact

The package gains automatic execution in the user's Claude Code workflow and can influence agent tool handling and session startup.

Mechanism

The postinstall hook launches the package CLI install command, which seeds the Claude configuration and installs hooks for tool and session events.

Policy narrative

The package declares a postinstall hook. On qualifying global installs, that hook launches its CLI with an install flag. The CLI writes Haus-managed Claude Code skills, agents, and hook settings, including commands attached to tool-use and session-start events. This is an unconsented install-time mutation of a broad AI-agent control surface.

AI rationale

The automatic global lifecycle path installs persistent Claude Code hooks and agent configuration. This meets the policy threshold for blocking unconsented install-time mutation of a broad AI-agent control surface.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

21function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L21

21Trigger-reachable chain: manifest.bin -> dist/cli.js L21: function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0959fb066f9d67a0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 shingleOverlap = 13 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

library/global/skills/request/scripts/korning.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @haus-tech/haus-workflow@5.7.0 matchedIdentity = npm:[redacted]:5.7.0 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

library/global/skills/request/scripts/korning.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/korning.mjsView on unpkg

library/global/skills/request/scripts/svep.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/svep.mjsView on unpkg

library/global/skills/request/scripts/archive.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/archive.mjsView on unpkg

library/global/skills/request/scripts/lib.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/lib.mjsView on unpkg

library/global/skills/request/scripts/report.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.10.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/report.mjsView on unpkg