registry / Install hook abuse / @indigoai-us/hq-cli
@indigoai-us/hq-cli
HQ by Indigo management CLI — modules and cloud sync
This report shows the evidence for @indigoai-us/hq-cli@5.345.145. 1 of 345 known versions is blocked or flagged. The newest version, 5.345.159, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe reachable postinstall path installs a persistent user service without requiring the consumer to invoke the daemon-install command. This is concrete install-hook persistence, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm runs its postinstall hook.
Impact
The install modifies user service configuration and establishes automatic background execution without a separate daemon-install command.
Mechanism
The hook launches the package CLI with `mesh daemon install --if-stale`; a missing daemon version is considered stale, so the installer creates the service.
Attack narrative
An npm installation runs a postinstall script that invokes the HQ CLI daemon installer. When no daemon version is recorded, the installer treats the daemon as stale and installs a user service; on macOS the service is configured to run at load and remain alive. This is automatic persistence established by the package install hook.
AI rationale
The reachable postinstall path installs a persistent user service without requiring the consumer to invoke the daemon-install command. This is concrete install-hook persistence, so the package should be blocked.
Evidence
package.jsonscripts/mesh-daemon-if-stale.mjsdist/commands/mesh.jsdist/lib/mesh/live/daemon/install.js
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines a postinstall hook that runs the daemon helper.
- The helper invokes the installed CLI to run `mesh daemon install --if-stale` during postinstall.
- A missing daemon version record counts as stale, and the stale path installs the daemon service.
- The macOS service is configured to start at load and stay alive.
- When --if-stale is set, the daemon install handler calls installDaemonIfStale with the current CLI version, platform, and install paths.
Evidence against
- The daemon is an advertised HQ mesh feature, and the postinstall helper skips staged updates.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
17 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/mesh-daemon-if-stale.mjs || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/mesh-daemon-if-stale.mjs || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/startup-registration.jsView file
18*/
L19: import { spawnSync } from "node:child_process";
L20: import { stringDerivedPackageRoot } from "./utils/hq-roots.js";
High
Child Process
Package source references child process execution.
dist/startup-registration.jsView on unpkg · L18Findings
1 Critical9 High9 Medium6 Low
CriticalCredential Exfiltrationdist/lib/capacity/collectors/claude-oauth.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/startup-registration.js
HighShelldist/utils/staged-install.js
HighSame File Env Network Executiondist/commands/rescue.js#virtual:normalized:round1
HighCommand Output Exfiltrationdist/commands/rescue.js#virtual:normalized:round1
HighCloud Metadata Accessdist/lib/lanes/machine-identity.js
HighTrigger Reachable Persistencedist/lib/mesh/live/daemon/install.js
HighPayload In Excluded Dirassets/scaffold/.claude/hooks/validate-policy-frontmatter.sh
HighSemantic Analysis Limitedassets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1
Affected versions and remediation
This report applies to @indigoai-us/hq-cli@5.345.145.
The versions list below shows the verdict for each recorded version.
- Avoid installing @indigoai-us/hq-cli@5.345.145. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.