Loading npm security reports…

@haus-tech/haus-workflow@5.8.0: AI-agent control-surface risk | LPM Firewall

registry / @haus-tech/haus-workflow / 5.8.0

@haus-tech/haus-workflow@5.8.0

Haus AI workflow CLI for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically runs haus install --postinstall, which writes Haus skills and merges hook, allow, and deny rules into the user's Claude Code settings. Those hooks intercept file and Bash tool use and also pin an external Claude plugin.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during a global install when CI, HAUS_NO_POSTINSTALL, and the package dev checkout gates are not set.

Impact

Claude Code tool execution and user-level agent settings are changed without a separate haus command, including PreToolUse guards and a third-party plugin install.

Mechanism

scripts/postinstall.mjs spawns dist/cli.js install --postinstall, which copies library/global assets into the Claude config directory, merges hooks.json into settings.json, and ensures the superpowers plugin pin.

Policy narrative

Installing this package globally runs a postinstall script that launches the bundled CLI with install --postinstall. That command writes Haus-managed skills and agents under the Claude config directory and merges settings so Haus commands run before file and Bash tools and on session stop. It also pins the superpowers plugin from a GitHub repository into the user plugin scope. An environment variable can skip the hook, but the default global install still mutates the agent control surface.

AI rationale

The postinstall path is an automatic global-install write into Claude Code's broad settings and hook surface, including tool-use interceptors and a third-party plugin pin. Opt-out flags and product labeling do not make that unconsented control-surface mutation consented.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

21function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L21

21Trigger-reachable chain: manifest.bin -> dist/cli.js L21: function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

library/global/skills/request/scripts/svep.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/svep.mjsView on unpkg

library/global/skills/request/scripts/archive.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/archive.mjsView on unpkg

library/global/skills/request/scripts/report.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/report.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 25-65json

25 "build": "rm -rf dist && esbuild src/cli.ts --bundle --packages=external --platform=node --format=esm --outdir=dist --external:@inquirer/checkbox",

26 "dev": "tsx src/cli.ts",

27 "test": "node scripts/test-fast.mjs",

28 "test:quick": "node scripts/test-fast.mjs --quick",

29 "test:full": "node scripts/run-tests.mjs tests/**/*.test.js",

30 "test:coverage": "c8 yarn test:full",

31 "coverage:check": "c8 --check-coverage yarn test:full",

32 "lint": "eslint src --cache --cache-location .eslintcache",

33 "format:check": "prettier --check --cache --cache-location .prettiercache .",

34 "format": "prettier --write --cache --cache-location .prettiercache .",

35 "typecheck": "tsc --noEmit",

36 "pack:local": "yarn pack",

37 "release": "GITHUB_TOKEN=$(gh auth token) release-it",

38 "release:dry": "GITHUB_TOKEN=$(gh auth token) release-it --dry-run",

39 "prepack": "yarn build",

40 "verify": "node scripts/verify.mjs",

41 "verify:full": "node scripts/verify.mjs --coverage",

42 "check:contract-behavior": "node --import tsx scripts/contract-behavior-check.mjs",

43 "check:mutation-table": "node scripts/check-mutation-table.mjs",

44 "check:docs-site": "node scripts/check-docs-site.mjs",

45 "postinstall": "node ./scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "prepare": "lefthook install || true",

47 "security:audit": "yarn npm audit -A -R --severity high --environment production"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "5.2.1",

51 "commander": "13.1.0",

52 "diff": "8.0.4",

53 "execa": "9.6.1",

54 "fast-glob": "3.3.3",

55 "fs-extra": "11.4.0",

56 "semver": "7.8.5",

57 "tar": "7.5.22",

58 "yaml": "2.9.0"

59 },

60 "devDependencies": {

61 "@release-it/conventional-changelog": "11.0.1",

62 "@types/fs-extra": "11.0.4",

63 "@types/node": "22.20.1",

64 "@types/semver": "7.8.0",

65 "@typescript-eslint/eslint-plugin": "8.69.0",

dist/cli.jsView file

21function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L21

21Trigger-reachable chain: manifest.bin -> dist/cli.js L21: function isOffline() { L22: return flagged || process.env["HAUS_OFFLINE"] === "1"; L23: } ... L45: if (override && override.trim().length > 0) return override; L46: return path.join(os.homedir(), ".claude"); L47: } ... L82: for (let i = 0; i < 12; i++) { L83: const pkgPath = path.join(dir, "package.json"); L84: if (existsSync(pkgPath)) { L85: try { L86: const pkg = JSON.parse(readFileSync(pkgPath, "utf8")); L87: if (pkg.name === "haus" || pkg.name === "@haus-tech/haus-workflow") return dir;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = dist/cli.js matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

library/global/skills/request/scripts/svep.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/svep.mjsView on unpkg

library/global/skills/request/scripts/archive.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/archive.mjsView on unpkg

library/global/skills/request/scripts/report.mjsView file

•matchType = normalized_sha256 matchedPackage = @haus-tech/haus-workflow@5.3.0 matchedPath = [redacted].mjs matchedIdentity = npm:[redacted]:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

library/global/skills/request/scripts/report.mjsView on unpkg