@heycatch/sdk@0.8.5
HeyCatch SDK
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe browser-session hijack hint was not substantiated: identity changes require an SDK API call. However, the bundled diagnostic explicitly directs readers to external agent instructions, which is a review boundary escape and evidence of malicious intent under the review rules.
Static reason
No blocking static signals were detected.
Trigger
The diagnostic is embedded in the internal development-build refusal path; the package build is marked prod.
Impact
Attempts to influence the review by directing it to external instructions; no account mutation or other runtime attack was established.
Mechanism
The message asks readers to consult a remote agents.md file, crossing the package review boundary.
Attack narrative
The bundle contains a diagnostic that directs readers to remote agents.md instructions. That is a review boundary escape and is treated as malicious reviewer manipulation, although the package’s prod stage makes the diagnostic path unreachable in this build. The flagged browser account hijack was not supported by the inspected source.
AI rationale
The browser-session hijack hint was not substantiated: identity changes require an SDK API call. However, the bundled diagnostic explicitly directs readers to external agent instructions, which is a review boundary escape and evidence of malicious intent under the review rules.
Evidence
dist/index.js
Network endpoints1
in.heycatch.ai
Decision evidence
public snapshotAI called this Malicious at 86.0% confidence as Malware with low false-positive risk.
Evidence for block
- A bundled diagnostic directs readers to “re-verify against https://heycatch.ai/agents.md,” sending the review outside the package boundary.
- That text is part of an internal development-build refusal diagnostic; the package sets its stage to prod, making that diagnostic unreachable in this build.
Evidence against
- The browser and server entry points are selected through package exports, with no lifecycle scripts in the manifest.
- Identity changes are exposed through an SDK API and require a call; I found no code that reuses an authenticated browser session to mutate account settings.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryTrivialUrlStrings
Source & flagged code
4 flaggeddist/index.jsView file
1var _d=Object.defineProperty;var vd=(t,e)=>{for(var r in e)_d(t,r,{get:e[r],enumerable:!0})};var ii="[a-z0-9]",$g=new RegExp(`^${ii}$`),si="heycatch";var md=/^(\d{1,3})\.(\d{1,3})\...
L2: `),d=u;l.length>d;d++){var h=l[d];if(1024>=h.length){var f=mu.test(h)?h.replace(mu,"$1"):h;if(!f.match(/\S*Error: /)){for(var p of s){var g=p(f,n);if(g){c.push(g);break}}if(c.lengt...
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/index.jsView on unpkg · L11with \`npm view @heycatch/sdk version\` (never a \`-dev.N\` version) - and re-verify against https://heycatch.ai/agents.md`}var Qr=["X-HeyCatch-Session-Id","X-HeyCatch-Window-Id","X-HeyCatch-Distinct
High
Ai Review Evidence
A bundled diagnostic directs readers to “re-verify against https://heycatch.ai/agents.md,” sending the review outside the package boundary.
dist/index.jsView on unpkg · L11",".vercel.app"];function Oh(t){let e=t.toLowerCase().replace(/\.$/,"");return Ah.some(r=>e.endsWith(r))}function Qa({stage:t,hostname:e}){return t!=="dev"||ai(e)||Oh(e)?null:`[HeyCatch] REFUSING to start: this is an int
High
Findings
4 High2 Medium5 Low
HighBrowser Session Account Hijackdist/index.js
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
HighAi Review Evidencedist/index.js
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @heycatch/sdk@0.8.5.
See all versions of @heycatch/sdk for other recorded verdicts.
- Avoid installing @heycatch/sdk@0.8.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.