registry / @holdyourvoice/hyv / 2.9.25

@holdyourvoice/hyv@2.9.25

Free local AI writing scan for cursor & claude. MCP server, 220+ pattern detection, voice profiles. npx @holdyourvoice/hyv welcome

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 4 file(s), 844 KB of source, external domains: 127.0.0.1, chatgpt.com, example.com, holdyourvoice.com, www.npmjs.com, x.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-36json

2 "name": "@holdyourvoice/hyv",

3 "version": "2.9.25",

4 "description": "Free local AI writing scan for cursor & claude. MCP server, 220+ pattern detection, voice profiles. npx @holdyourvoice/hyv welcome",

5 "main": "dist/index.js",

6 "bin": {

7 "hyv": "dist/index.js",

8 "hyvoice": "dist/index.js"

9 },

10 "scripts": {

11 "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --external:canvas --banner:js='#!/usr/bin/env node'",

12 "build:debug": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --sourcemap --banner:js='#!/usr/bin/env node'",

13 "dev": "npm run build && node dist/index.js",

14 "validate:publish": "npm run build && node scripts/validate-publish.js",

15 "prepublishOnly": "npm run validate:publish",

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "prepare": "npm run build",

18 "test": "npm run build && vitest run",

19 "test:smoke": "npm run build && bash scripts/smoke-test.sh",

20 "test:watch": "vitest",

21 "release:patch": "npm version patch && npm publish --access public",

22 "release:minor": "npm version minor && npm publish --access public",

23 "release:major": "npm version major && npm publish --access public"

24 },

25 "keywords": [

26 "voice",

27 "writing",

28 "ai",

29 "cli",

30 "brand-voice",

31 "content-gate",

32 "hyv",

33 "cursor",

34 "claude",

35 "mcp",

36 "ai-agent",

dist/index.jsView file

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 3819 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 3819 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

Findings

1 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

package.jsonView file

Lines 1-36json

2 "name": "@holdyourvoice/hyv",

3 "version": "2.9.25",

4 "description": "Free local AI writing scan for cursor & claude. MCP server, 220+ pattern detection, voice profiles. npx @holdyourvoice/hyv welcome",

5 "main": "dist/index.js",

6 "bin": {

7 "hyv": "dist/index.js",

8 "hyvoice": "dist/index.js"

9 },

10 "scripts": {

11 "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --external:canvas --banner:js='#!/usr/bin/env node'",

12 "build:debug": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --sourcemap --banner:js='#!/usr/bin/env node'",

13 "dev": "npm run build && node dist/index.js",

14 "validate:publish": "npm run build && node scripts/validate-publish.js",

15 "prepublishOnly": "npm run validate:publish",

16 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L16

17 "prepare": "npm run build",

18 "test": "npm run build && vitest run",

19 "test:smoke": "npm run build && bash scripts/smoke-test.sh",

20 "test:watch": "vitest",

21 "release:patch": "npm version patch && npm publish --access public",

22 "release:minor": "npm version minor && npm publish --access public",

23 "release:major": "npm version major && npm publish --access public"

24 },

25 "keywords": [

26 "voice",

27 "writing",

28 "ai",

29 "cli",

30 "brand-voice",

31 "content-gate",

32 "hyv",

33 "cursor",

34 "claude",

35 "mcp",

36 "ai-agent",

dist/index.jsView file

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 3819 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg