Loading npm security reports…

@haus-tech/haus-workflow@5.3.0: AI-agent control-surface risk | LPM Firewall

registry / @haus-tech/haus-workflow / 5.3.0

@haus-tech/haus-workflow@5.3.0

Haus AI workflow CLI for Claude Code.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically changes the user's Claude Code control surface. It writes managed configuration, registers command hooks, and can install a third-party global plugin.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global installation, unless CI or HAUS_NO_POSTINSTALL=1 prevents it.

Impact

Commands executed by Claude Code can be intercepted by package-provided hooks, and an external plugin is installed without an explicit installer command.

Mechanism

Postinstall invokes the CLI installer, which modifies Claude Code settings and plugin state.

Policy narrative

Installing this package globally triggers its postinstall script. That script runs the CLI installer, which modifies the user's Claude Code settings, installs hooks for Bash and file operations, and installs a third-party plugin from GitHub at user scope. These changes occur without an explicit Haus setup command.

AI rationale

The automatic global-install lifecycle mutates a broad AI-agent control surface and installs external plugin code. This meets the policy threshold for unconsented postinstall control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.jslibrary/global/settings-fragments/hooks.json~/.claude/settings.json~/.claude/skills/*~/.claude/agents/*~/.claude/haus/install-manifest.json

Network endpoints1

Source & flagged code

4 flagged

package.jsonView file

Lines 25-65json

25 "build": "rm -rf dist && esbuild src/cli.ts --bundle --packages=external --platform=node --format=esm --outdir=dist --external:@inquirer/checkbox",

26 "dev": "tsx src/cli.ts",

27 "test": "node scripts/test-fast.mjs",

28 "test:quick": "node scripts/test-fast.mjs --quick",

29 "test:full": "node scripts/run-tests.mjs tests/**/*.test.js",

30 "test:coverage": "c8 yarn test:full",

31 "coverage:check": "c8 --check-coverage yarn test:full",

32 "lint": "eslint src --cache --cache-location .eslintcache",

33 "format:check": "prettier --check --cache --cache-location .prettiercache .",

34 "format": "prettier --write --cache --cache-location .prettiercache .",

35 "typecheck": "tsc --noEmit",

36 "pack:local": "yarn pack",

37 "release": "GITHUB_TOKEN=$(gh auth token) release-it",

38 "release:dry": "GITHUB_TOKEN=$(gh auth token) release-it --dry-run",

39 "prepack": "yarn build",

40 "verify": "node scripts/verify.mjs",

41 "verify:full": "node scripts/verify.mjs --coverage",

42 "check:contract-behavior": "node --import tsx scripts/contract-behavior-check.mjs",

43 "check:mutation-table": "node scripts/check-mutation-table.mjs",

44 "check:docs-site": "node scripts/check-docs-site.mjs",

45 "postinstall": "node ./scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "prepare": "lefthook install || true",

47 "security:audit": "yarn npm audit -A -R --severity high --environment production"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "5.2.1",

51 "commander": "13.1.0",

52 "diff": "8.0.4",

53 "execa": "9.6.1",

54 "fast-glob": "3.3.3",

55 "fs-extra": "11.4.0",

56 "semver": "7.8.5",

57 "tar": "7.5.22",

58 "yaml": "2.9.0"

59 },

60 "devDependencies": {

61 "@release-it/conventional-changelog": "11.0.1",

62 "@types/fs-extra": "11.0.4",

63 "@types/node": "22.20.1",

64 "@types/semver": "7.8.0",

65 "@typescript-eslint/eslint-plugin": "8.67.0",

dist/cli.jsView file

21function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L21

21Trigger-reachable chain: manifest.bin -> dist/cli.js L21: function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L21