registry / @hipmmai/hipmmcode / 1.0.7

@hipmmai/hipmmcode@1.0.7

Provider-agnostic AI coding agent for your terminal (binary distribution)

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package fetches an unpinned external archive and executes code from it. It may also install skills into the user's Hipmmcode directory.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation

Impact

A substituted or compromised release archive can execute with the installing user's permissions and modify Hipmmcode skills.

Mechanism

remote binary download, quarantine removal, and automatic execution

AI rationale

The package uses an automatic lifecycle hook to execute an unverified remote binary and install agent skills. This is a concrete supply-chain risk, but the inspected source alone does not establish malicious intent or direct exfiltration.

Evidence

package.jsoninstall.jsdist/hipmmcode.tar.gzdist/hipmmcodedist/default-skills/~/.hipmmcode/skills

Network endpoints1

github.com/${REPO}/releases/latest/download/hipmmcode-${label()}.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with false-positive risk.

@hipmmai/hipmmcode@1.0.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code