registry / @hipmmai/hipmmcode / 1.0.0

@hipmmai/hipmmcode@1.0.0

Provider-agnostic AI coding agent for your terminal (binary distribution)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Installation fetches a mutable remote archive, extracts it, and may execute its binary during postinstall. The shipped JS does not establish a specific theft or destructive action.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

A changed or compromised release can execute arbitrary code with installer privileges.

Mechanism

unverified remote binary download and install-time execution

AI rationale

Source confirms install-time retrieval and execution of an unverified mutable binary, but does not show a concrete malicious objective in the shipped source.

Evidence

package.jsoninstall.jsbin/run.jsdist/hipmmcode.tar.gzdist/hipmmcode

Network endpoints1

github.com/${REPO}/releases/latest/download/hipmmcode-${label()}.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs postinstall: node install.js

@hipmmai/hipmmcode@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code