registry / @hipmmai/hipmmcode / 1.0.4

@hipmmai/hipmmcode@1.0.4

Provider-agnostic AI coding agent for your terminal (binary distribution)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

npm installation downloads an unverified, mutable release tarball then extracts it. If the tarball includes the expected skills manifest, its binary runs during postinstall and may modify its own skills directory.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

A changed remote release can run arbitrary native code at install time.

Mechanism

remote binary download, extraction, and conditional execution

AI rationale

This is a concrete install-time staged-payload capability but the inspected source shows a package-aligned binary-distribution design rather than direct theft or sabotage. Warn pending trusted artifact integrity or source review.

Evidence

package.jsoninstall.jsbin/run.jsdist/hipmmcode.tar.gzdist/hipmmcodedist/default-skills/MANIFEST.toml~/.hipmmcode/skills

Network endpoints1

github.com/${REPO}/releases/latest/download/hipmmcode-${label()}.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence with false-positive risk.

@hipmmai/hipmmcode@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code