registry / AI-agent control-surface risk / @holdyourvoice/hyv-pro

@holdyourvoice/hyv-pro

Paid Hold Your Voice CLI with profile-aware writing checks and MCP setup.

This report shows the evidence for @holdyourvoice/hyv-pro@2.9.30, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. The opt-out environment variable and lack of postinstall networking do not remove the install-time control-hijack behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of @holdyourvoice/hyv-pro@2.9.30

Impact

Future Cursor, Claude, Codex, Windsurf, OpenCode, and Antigravity sessions can load package-controlled MCP tooling and directives.

Mechanism

unconsented install-time AI-agent configuration and instruction injection

Policy narrative

On installation, postinstall invokes setupAgents with auto-configuration enabled by default. That routine creates or edits global configuration and instruction files for multiple unrelated AI-agent products, registering the package's local MCP server and adding always-on rules without a user command or consent. These changes cause later agent sessions to load package-provided capabilities and behavioral directives.

AI rationale

Evidence

package.jsonscripts/postinstall.jsscripts/postinstall-lib.jsagents/AGENTS.mddist/index.jsagents/cursor.mdagents/claude-code.mdskills/hold-your-voice/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs scripts/postinstall.js on npm install.
scripts/postinstall.js calls setupAgents without user confirmation.
scripts/postinstall-lib.js creates MCP/rule/instruction files for Cursor, Claude, Codex, Windsurf, OpenCode, and Antigravity.
The installer adds a local executable MCP server and always-on agent instructions to foreign global config locations.
agents/AGENTS.md directs agents to auto-run HYV tools for eligible user content.

Evidence against

HYV_AUTO_CONFIGURE_AGENTS=0 can disable setup, but default behavior is enabled.
No network request or credential harvesting occurs in the postinstall path itself.
dist/index.js telemetry is opt-in and stored locally.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

5 flagged

package.jsonView file

Lines 1-36json

2 "name": "@holdyourvoice/hyv-pro",

3 "version": "2.9.30",

4 "description": "Paid Hold Your Voice CLI with profile-aware writing checks and MCP setup.",

5 "main": "dist/index.js",

6 "bin": {

7 "hyv": "dist/index.js",

8 "hyvoice": "dist/index.js"

9 },

10 "scripts": {

11 "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --external:canvas --banner:js='#!/usr/bin/env node'",

12 "build:debug": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --sourcemap --banner:js='#!/usr/bin/env node'",

13 "dev": "npm run build && node dist/index.js",

14 "validate:publish": "npm run build && node scripts/validate-publish.js",

15 "prepublishOnly": "npm run validate:publish",

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "prepare": "npm run build",

18 "test": "npm run build && vitest run",

19 "test:smoke": "npm run build && bash scripts/smoke-test.sh",

20 "test:watch": "vitest",

21 "release:patch": "npm version patch && npm publish --access public",

22 "release:minor": "npm version minor && npm publish --access public",

23 "release:major": "npm version major && npm publish --access public"

24 },

25 "keywords": [

26 "voice",

27 "writing",

28 "ai",

29 "cli",

30 "brand-voice",

31 "content-gate",

32 "hyv",

33 "cursor",

34 "claude",

35 "mcp",

36 "ai-agent",

dist/index.jsView file

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

scripts/postinstall-lib.jsView file

Lines 18-58javascript

18 return JSON.parse(fs.readFileSync(markerPath, 'utf-8'));

19 } catch {

20 return null;

21 }

22}

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 3827 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

Findings

1 Critical1 High6 Medium6 Low

CriticalAi Agent Control Hijackscripts/postinstall-lib.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @holdyourvoice/hyv-pro@2.9.30.

The versions list below shows the verdict for each recorded version.

Avoid installing @holdyourvoice/hyv-pro@2.9.30. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 08:35:28.159Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

2.9.30latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 5, 2026, 2:21 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages