Loading npm security reports…
@indigoai-us/hq-cli@5.345.146: Persistence – npm package flagged | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 37 finding(s) warrant review before installing.
scanned 6d ago · by lpm-firewall-ai The source establishes automatic installation of a persistent user-level daemon, so this warrants a warning about install-time persistence. The inspected Claude OAuth code is gated by an enabled marker and sends requests to Anthropic endpoints; it does not establish credential exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Installing the npm package runs its postinstall hook.
Impact
The daemon may run persistently under the user's account after package installation without a separate explicit daemon-install command.
Mechanism
The hook invokes the HQ CLI with `mesh daemon install --if-stale`; a missing daemon version record is treated as stale, and the installer sets up a platform user service.
AI rationale
The source establishes automatic installation of a persistent user-level daemon, so this warrants a warning about install-time persistence. The inspected Claude OAuth code is gated by an enabled marker and sends requests to Anthropic endpoints; it does not establish credential exfiltration.
Evidence
package.json scripts/mesh-daemon-if-stale.mjs dist/lib/mesh/live/daemon/install.js
public snapshot AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
package.json runs a postinstall script that invokes the mesh daemon installer. The postinstall script runs the CLI command `mesh daemon install --if-stale`. The installer installs a user-level daemon service when the CLI version is newer or its Node path needs repair; a missing version record counts as stale. The Claude OAuth collector skips collection unless its enabled marker is set, and its inspected endpoints are Anthropic OAuth endpoints. Evidence against
The daemon installation is an identifiable HQ product feature, and the installer avoids reinstalling when the installed daemon is current and its Node path is healthy. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell
Supply chain HighEntropyStrings Minified UrlStrings
Manifest
29 flagged · loading source • scripts.postinstall = node scripts/mesh-daemon-if-stale.mjs || true
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/mesh-daemon-if-stale.mjs || true
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 18 */
L19: import { spawnSync } from "node:child_process";
L20: import { stringDerivedPackageRoot } from "./utils/hq-roots.js";
High Child Process
Package source references child process execution.
dist/startup-registration.js View on unpkg · L18 1 Critical 21 High 9 Medium 6 Low
Critical Credential Exfiltration dist/lib/capacity/collectors/claude-oauth.js
High Install Time Lifecycle Scripts package.json
High Child Process dist/startup-registration.js
High Shell dist/utils/staged-install.js
High Same File Env Network Execution dist/commands/rescue.js#virtual:normalized:round1
High Command Output Exfiltration dist/commands/rescue.js#virtual:normalized:round1
High Cloud Metadata Access dist/lib/lanes/machine-identity.js
High Trigger Reachable Persistence dist/lib/mesh/live/daemon/install.js
High Payload In Excluded Dir assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh
High Semantic Analysis Limited assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1
Affected versions and remediation This report applies to @indigoai-us/hq-cli@5.345.146 .
See all versions of @indigoai-us/hq-cli for other recorded verdicts.
Review the evidence and your use of @indigoai-us/hq-cli@5.345.146 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-17 07:58:56.480Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
No manifest risk signals triggered.
scanned 970 file(s), 13.5 MB of source, external domains: 127.0.0.1, a.co, api.anthropic.com, api.github.com, api.indigo-hq.com, api.openai.com, api.slack.com, cli-chat-proxy.grok.com, console.anthropic.com, docs.hq.computer, example.com, github.com, gmailmcp.googleapis.com, hq.computer, hq.getindigo.ai, hq.indigo.ai, hqapi.hq.computer, json-schema.org, nodejs.org, onboarding.hq.computer, registry.npmjs.org, schemas.microsoft.com, www.apple.com
Oversized source lightweight scan
dist/hq-cloud-sync-runner/bin/sync-runner.js 5.89 MB file, sampled 256 KB
Filesystem EnvironmentVars HighEntropyStrings UrlStrings a.co github.com hqapi.hq.computer
336 env: childEnv,
L337: shell: true,
L338: stdio: "ignore",
dist/utils/update-command-supervisor.cjs View file 2 L3: const { spawn: nativeSpawn } = require("node:child_process");
L4: const fs = require("node:fs");
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/utils/update-command-supervisor.cjs View on unpkg · L2 2 import * as crypto from "node:crypto";
L3: import { spawnSync } from "node:child_process";
L4: import * as fs from "node:fs";
...
L20: /** The status file path used by hq-cloud's watch-owner lease. */
L21: export function watchRunnerOwnerStatusPath(hqRoot, home = os.homedir(), env = process.env) {
L22: let canonicalRoot = path.resolve(hqRoot);
...
L39: try {
L40: parsed = JSON.parse(fs.readFileSync(statusPath, "utf8"));
L41: }
...
L128: const variants = new Set([pathApi.resolve(hqRoot)]);
L129: if (platform === process.platform) {
L130: try {
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/lib/daemon/sync-runner.js View on unpkg · L2 dist/lib/mesh/live/daemon/install.js View file 7 Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/main.js -> dist/utils/self-update.js -> [redacted].js
L7: * - Windows: per-user Scheduled Task ai.getindigo.hq-mesh-daemon registered
L8: * from a rendered task XML via schtasks.exe (no native dependencies)
L9: *
...
L16: import * as path from "node:path";
L17: import { spawnSync } from "node:child_process";
L18: import semver from "semver";
...
L54: status: r.status,
L55: stdout: r.stdout ?? "",
L56: stderr: r.error ? r.error.message : (r.stderr ?? ""),
...
L62: const raw = readFileSync(file);
L63: const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(String(raw));
L64: if ((buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) || buf.includes(0)) {
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/lib/mesh/live/daemon/install.js View on unpkg · L7 • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = [redacted].js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/mesh/live/daemon/install.js View on unpkg 7 * - Windows: per-user Scheduled Task ai.getindigo.hq-mesh-daemon registered
L8: * from a rendered task XML via schtasks.exe (no native dependencies)
L9: *
...
L16: import * as path from "node:path";
L17: import { spawnSync } from "node:child_process";
L18: import semver from "semver";
...
L54: status: r.status,
L55: stdout: r.stdout ?? "",
L56: stderr: r.error ? r.error.message : (r.stderr ?? ""),
...
L62: const raw = readFileSync(file);
L63: const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(String(raw));
L64: if ((buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) || buf.includes(0)) {
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/mesh/live/daemon/install.js View on unpkg · L7 dist/commands/rescue.js#virtual:normalized:round1 View file 1 import { spawnSync } from "child_process";
L2: import * as fs from "fs";
...
L11: /**
L12: * Resolve the source repo + ref from the user"s flags. Pure + exported for\n * tests. `latestTag` is the resolved latest release tag (prod only); ignored\n * for staging and when a...
L13: if (!ref) {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/commands/rescue.js#virtual:normalized:round1 View on unpkg · L1 1 import { spawnSync } from "child_process";
L2: import * as fs from "fs";
...
L11: /**
L12: * Resolve the source repo + ref from the user"s flags. Pure + exported for\n * tests. `latestTag` is the resolved latest release tag (prod only); ignored\n * for staging and when a...
L13: if (!ref) {
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/commands/rescue.js#virtual:normalized:round1 View on unpkg · L1 dist/lib/capacity/collectors/claude-oauth.js View file 6 * or the credentials JSON under ~/.claude/ on Linux). GETs
L7: * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta
L8: * header. This module does not invoke the claude CLI except
...
L31: */
L32: import { execFile, spawnSync } from "node:child_process";
L33: import * as crypto from "node:crypto";
...
L81: }
L82: export function defaultClaudeCredentialsPath(home = os.homedir()) {
L83: return path.join(home, ".claude", ".credentials.json");
...
L279: retryAfter = response.headers?.get("retry-after") ?? null;
L280: text = status === 200 ? await response.text() : "";
L281: }
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/capacity/collectors/claude-oauth.js View on unpkg · L6 11 */
L12: import { spawnSync } from "node:child_process";
L13: import * as os from "node:os";
L14: export const IMDS_HOST = "169.254.169.254";
L15: export const IMDS_TOKEN_URL = `http://${IMDS_HOST}/latest/api/token`;
L16: export const IMDS_INSTANCE_ID_URL = `http://${IMDS_HOST}/latest/meta-data/instance-id`;
...
L30: return null;
L31: const body = (result.stdout ?? "").trim();
L32: return body.length > 0 ? body : null;
...
L34: catch (err) {
L35: process.stderr.write(`hq lanes: IMDS request failed for ${url}: ${err instanceof Error ? err.message : String(err)}\n`);
L36: return null;
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/lib/lanes/machine-identity.js View on unpkg · L11 assets/lanes-hooks/hq-lanes-drain.sh View file • path = assets/lanes-hooks/hq-lanes-drain.sh
kind = build_helper
sizeBytes = 620
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
assets/lanes-hooks/hq-lanes-drain.sh View on unpkg assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh View file • path = assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh
kind = payload_in_excluded_dir
sizeBytes = 21475
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh View on unpkg dist/hq-cloud-sync-runner/bin/sync-runner.js View file • path = dist/hq-cloud-sync-runner/bin/sync-runner.js
kind = oversized_source_file
sizeBytes = 6171856
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/hq-cloud-sync-runner/bin/sync-runner.js View on unpkg • path = dist/hq-cloud-sync-runner/bin/sync-runner.js
kind = oversized_cli_entrypoint
sizeBytes = 6171856
magicHex = [redacted]
Medium Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/hq-cloud-sync-runner/bin/sync-runner.js View on unpkg assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 44
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/commands/storage-offload.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/storage-offload.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/index.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/commands/lanes.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/lanes.js View on unpkg dist/lib/lanes/outpost-worktree-pruner.js View file • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/outpost-worktree-pruner.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/outpost-worktree-pruner.js View on unpkg dist/lib/lanes/remote-control-lane.js View file • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/remote-control-lane.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/remote-control-lane.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/spawn.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/spawn.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/throttle.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/throttle.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/search-index/index.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/search-index/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/utils/package-use-lease.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/package-use-lease.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/utils/self-update.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/self-update.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/utils/version-gate.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/version-gate.js View on unpkg High Known Malware Source Similarity dist/commands/storage-offload.js
High Known Malware Source Similarity dist/index.js
High Known Malware Source Similarity dist/lib/mesh/live/daemon/install.js
High Known Malware Source Similarity dist/commands/lanes.js
High Known Malware Source Similarity dist/lib/lanes/outpost-worktree-pruner.js
High Known Malware Source Similarity dist/lib/lanes/remote-control-lane.js
High Known Malware Source Similarity dist/lib/lanes/spawn.js
High Known Malware Source Similarity dist/lib/lanes/throttle.js
High Known Malware Source Similarity dist/lib/search-index/index.js
High Known Malware Source Similarity dist/utils/package-use-lease.js
High Known Malware Source Similarity dist/utils/self-update.js
High Known Malware Source Similarity dist/utils/version-gate.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/utils/update-command-supervisor.cjs
Medium Install Persistence dist/lib/mesh/live/daemon/install.js
Medium Ships Build Helper assets/lanes-hooks/hq-lanes-drain.sh
Medium Oversized Source File dist/hq-cloud-sync-runner/bin/sync-runner.js
Medium Oversized Cli Entrypoint dist/hq-cloud-sync-runner/bin/sync-runner.js
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/lib/daemon/sync-runner.js
Entrypoints
main → dist/index.js types → ./dist/index.d.ts bin → hq, hq-auth-refresh
Artifact 24.4 MB · 2,051 files 2 signature(s)
Install lifecycle postinstall prepare prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Filesystem Network Shell HighEntropyStrings Minified UrlStrings Manifest: clean
29 flagged Lines 23-63 json
24 "scripts/mesh-daemon-if-stale.mjs"
27 "build" : "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs && node scripts/bundle-sync-runner.mjs" ,
28 "prepublishOnly" : "npm run build" ,
29 "pretypecheck" : "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs" ,
30 "typecheck" : "tsc --noEmit && tsc --noEmit -p tsconfig.typetest.json" ,
31 "gen:scan-golden" : "node scripts/generate-scan-packages-table.mjs > src/utils/__fixtures__/scan-packages.generated-block.sh" ,
32 "gen:command-catalog" : "tsc && node scripts/generate-command-catalog.mjs" ,
34 "pretest" : "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs" ,
36 "gen:hq-mcp-tools" : "node scripts/generate-hq-mcp-tools.mjs" ,
37 "test:db" : "vitest run src/lib/db test/commands/db.test.ts test/commands/db-tenant-isolation.test.ts" ,
38 "test:e2e" : "vitest run --config vitest.e2e.config.ts" ,
39 "coverage" : "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary" ,
40 "check:lanes-module-cycles" : "node scripts/check-lanes-module-cycles.mjs" ,
42 "clean" : "rm -rf dist" ,
43 "postinstall" : "node scripts/mesh-daemon-if-stale.mjs || true" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L43 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L43 44 "prepare" : "husky || true" ,
45 "check:no-hermes" : "bash scripts/check-no-hermes.sh"
48 "@aws-sdk/client-iot-data-plane" : "^3.1096.0" ,
49 "@aws-sdk/client-s3" : "^3.1049.0" ,
50 "@aws-sdk/dsql-signer" : "^3.1146.0" ,
51 "@indigoai-us/hq-cloud" : "~6.18.82" ,
52 "@indigoai-us/hq-flags-client" : "^0.1.2" ,
53 "@modelcontextprotocol/sdk" : "1.29.0" ,
54 "@sentry/node" : "^10.49.0" ,
55 "@tobilu/qmd" : "2.5.3" ,
57 "better-sqlite3" : "^12.11.1" ,
59 "commander" : "^12.1.0" ,
Lines 1-38 javascript
2 * The command-registration recovery seam for the "install tree torn out from
3 * under a starting `hq`" condition (Sentry HQ-CLI-1G/1H/1J/1K).
5 * `runCli` registers commands as its last step before `program.parseAsync()` —
6 * the lazy command import or `import("./register-all.js")` and everything those
7 * pull in. That is the ONE place a module-resolution failure is provably safe to
8 * recover from: it is inside hq-cli's own graph, it runs before `parseAsync` and
9 * before the preAction hook, so no command action, telemetry, or stdin read has
Lines 316-346 javascript
316 if (result.status !== 0 )
318 const lines = (result.stdout ?? "" ). trim ().
dist/utils/update-command-supervisor.cjs View file Lines 1-22 javascript
3 const { spawn : nativeSpawn } = require ( "node:child_process" );
4 const fs = require ( "node:fs" );
Lines 1-22 javascript
1 /** Local status and resource controls shared by the daemon and its sync runner. */
2 import * as crypto from "node:crypto" ;
3 import { spawnSync } from "node:child_process" ;
dist/lib/mesh/live/daemon/install.js View file Lines 1-27 javascript
2 * User-level service install for hq mesh daemon.
4 * - macOS: LaunchAgent ai.getindigo.hq-mesh-daemon
5 * - Linux: systemd user unit hq-mesh-daemon.service
6 * (documented fallback: root-owned unit running as ec2-user)
7 * - Windows: per-user Scheduled Task ai.getindigo.hq-mesh-daemon registered
8 * from a rendered task XML via schtasks.exe (no native dependencies)
10 * The unit embeds the hq binary resolved at install time. Logs go to
dist/commands/rescue.js#virtual:normalized:round1 View file 1 import { spawnSync } from "child_process";
L2: import * as fs from "fs";
...
L11: /**
L12: * Resolve the source repo + ref from the user"s flags. Pure + exported for\n * tests. `latestTag` is the resolved latest release tag (prod only); ignored\n * for staging and when a...
L13: if (!ref) {
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/commands/rescue.js#virtual:normalized:round1 View on unpkg · L1 1 import { spawnSync } from "child_process";
L2: import * as fs from "fs";
...
L11: /**
L12: * Resolve the source repo + ref from the user"s flags. Pure + exported for\n * tests. `latestTag` is the resolved latest release tag (prod only); ignored\n * for staging and when a...
L13: if (!ref) {
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/commands/rescue.js#virtual:normalized:round1 View on unpkg · L1 dist/lib/capacity/collectors/claude-oauth.js View file 6 * or the credentials JSON under ~/.claude/ on Linux). GETs
L7: * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta
L8: * header. This module does not invoke the claude CLI except
...
L31: */
L32: import { execFile, spawnSync } from "node:child_process";
L33: import * as crypto from "node:crypto";
...
L81: }
L82: export function defaultClaudeCredentialsPath(home = os.homedir()) {
L83: return path.join(home, ".claude", ".credentials.json");
...
L279: retryAfter = response.headers?.get("retry-after") ?? null;
L280: text = status === 200 ? await response.text() : "";
L281: }
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/capacity/collectors/claude-oauth.js View on unpkg · L6 11 */
L12: import { spawnSync } from "node:child_process";
L13: import * as os from "node:os";
L14: export const IMDS_HOST = "169.254.169.254";
L15: export const IMDS_TOKEN_URL = `http://${IMDS_HOST}/latest/api/token`;
L16: export const IMDS_INSTANCE_ID_URL = `http://${IMDS_HOST}/latest/meta-data/instance-id`;
...
L30: return null;
L31: const body = (result.stdout ?? "").trim();
L32: return body.length > 0 ? body : null;
...
L34: catch (err) {
L35: process.stderr.write(`hq lanes: IMDS request failed for ${url}: ${err instanceof Error ? err.message : String(err)}\n`);
L36: return null;
High Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/lib/lanes/machine-identity.js View on unpkg · L11 assets/lanes-hooks/hq-lanes-drain.sh View file • path = assets/lanes-hooks/hq-lanes-drain.sh
kind = build_helper
sizeBytes = 620
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
assets/lanes-hooks/hq-lanes-drain.sh View on unpkg assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh View file • path = assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh
kind = payload_in_excluded_dir
sizeBytes = 21475
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh View on unpkg dist/hq-cloud-sync-runner/bin/sync-runner.js View file • path = dist/hq-cloud-sync-runner/bin/sync-runner.js
kind = oversized_source_file
sizeBytes = 6171856
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
dist/hq-cloud-sync-runner/bin/sync-runner.js View on unpkg • path = dist/hq-cloud-sync-runner/bin/sync-runner.js
kind = oversized_cli_entrypoint
sizeBytes = 6171856
magicHex = [redacted]
Medium Oversized Cli Entrypoint
Package contains an oversized executable-looking CLI entrypoint.
dist/hq-cloud-sync-runner/bin/sync-runner.js View on unpkg assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 44
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/commands/storage-offload.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/storage-offload.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/index.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/commands/lanes.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/commands/lanes.js View on unpkg dist/lib/lanes/outpost-worktree-pruner.js View file • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/outpost-worktree-pruner.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/outpost-worktree-pruner.js View on unpkg dist/lib/lanes/remote-control-lane.js View file • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/remote-control-lane.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/remote-control-lane.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/spawn.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/spawn.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/lanes/throttle.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/lanes/throttle.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/lib/search-index/index.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/search-index/index.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/utils/package-use-lease.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/package-use-lease.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/utils/self-update.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/self-update.js View on unpkg • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = dist/utils/version-gate.js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/utils/version-gate.js View on unpkg * happened yet, and a single re-exec can therefore never run a command twice.
12 * This wraps the existing `register()` call with exactly that recovery, driven by
13 * the classifier / probe / settle wait / carrier in ./utils/install-tree-torn.ts.
14 * It changes nothing about WHICH modules are imported or in what order — only the
15 * failure handling around the existing imports. Dependency-injected in the house
16 * style of handleTopLevelError so the whole seam is unit-testable without real
17 * spawns, waits, or a real install tree.
19 import { spawnSync } from "node:child_process" ;
20 import { stringDerivedPackageRoot } from "./utils/hq-roots.js" ;
High Child Process
Package source references child process execution.
dist/startup-registration.js View on unpkg · L18 21 import { updateLockPath, UPDATE_LOCK_STALE_MS } from "./utils/update-lock.js" ;
22 import { classifyEvalThrow, classifyModuleNotFound, installRewriteInProgress, InstallTreeTornError, waitForInstallTreeSettled, } from "./utils/install-tree-torn.js" ;
24 * Set on the re-exec'd child so it can NEVER wait or re-exec again — distinct
25 * from self-update's HQ_RESCUE_SELF_UPDATED so the two recovery paths cannot
28 export const INSTALL_TREE_RECOVERY_GUARD_ENV = "HQ_INSTALL_TREE_RECOVERED" ;
29 /** Carries the writer-state observed by the parent into the guarded re-exec. */
30 export const INSTALL_TREE_RECOVERY_TREE_STATE_ENV = "HQ_INSTALL_TREE_RECOVERY_TREE_STATE" ;
31 /** Operator override for the settle wait's deadline. */
32 export const INSTALL_SETTLE_TIMEOUT_ENV = "HQ_INSTALL_SETTLE_TIMEOUT_MS" ;
33 /** Default settle deadline (ms). Overridable by { @link INSTALL_SETTLE_TIMEOUT_ENV } . */
34 export const DEFAULT_INSTALL_SETTLE_TIMEOUT_MS = 90_000 ;
36 * The single dim, informational line emitted when — and only when — a wait
37 * actually happens. It tells a human why the command paused and is the e2e's
38 * synchronization point; it is never a remedy and never sets an error exit code.
split
(
/
\r
?
\n
/
);
319 return lines[lines. length - 1 ]?. trim () || null ;
321 function runPackagePostinstall ( packageRoot , env ) {
324 const pkg = JSON . parse (fs. readFileSync (path. join (packageRoot, "package.json" ), "utf8" ));
325 script = pkg.scripts?.postinstall;
330 if ( typeof script !== "string" || script. trim () === "" )
332 const childEnv = { ... env };
333 delete childEnv[ STAGED_INSTALL_ENV ];
339 timeout: POSTINSTALL_TIMEOUT_MS ,
343 function message ( error ) {
344 return error instanceof Error ? error.message : String (error);
346 //# sourceMappingURL=staged-install.js.map
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/utils/update-command-supervisor.cjs View on unpkg · L2 6 const KNOWN_NPM_ERROR_CODES = new Set ([
19 function windowsTaskkillArgs ( pid ) {
20 return [ "/PID" , String (pid), "/T" , "/F" ];
from
"node:fs"
;
5 import * as os from "node:os" ;
6 import * as path from "node:path" ;
7 export const SYNC_RUNNER_OWNER = "hq-daemon" ;
8 export const SYNC_RUNNER_LEASE_CONFLICT_EXIT = 20 ;
9 export const SYNC_RUNNER_LEASE_RETRY_MS = 15_000 ;
10 export const DEFAULT_SYNC_HEARTBEAT_TIMEOUT_MS = 300_000 ;
11 export const DEFAULT_SYNC_RUNNER_HEAP_MB = 3_584 ;
12 export const SYNC_HEARTBEAT_TIMEOUT_ENV = "HQ_DAEMON_SYNC_HEARTBEAT_TIMEOUT_SECONDS" ;
13 export const SYNC_RUNNER_HEAP_ENV = "HQ_SYNC_RUNNER_MAX_OLD_SPACE_MB" ;
14 const SYNC_RUNNER_COMMAND = /(?: ^| [\s/ \\ ] )(?:sync-runner \. js | hq-sync-runner(?: \. (?:cmd | exe)) ? )(?: [\s"'] |$ )/ i ;
15 function record ( value ) {
16 return value !== null && typeof value === "object" && ! Array. isArray (value)
20 /** The status file path used by hq-cloud's watch-owner lease. */
21 export function watchRunnerOwnerStatusPath ( hqRoot , home = os. homedir (), env = process.env) {
22 let canonicalRoot = path. resolve (hqRoot);
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/lib/daemon/sync-runner.js View on unpkg · L2 11 * ~/.hq/work-mesh/daemon/log (rotation at 5MB handled by the daemon).
12 * Tests must not actually install services — use a temp HOME/prefix.
14 import * as fs from "node:fs" ;
15 import * as os from "node:os" ;
16 import * as path from "node:path" ;
17 import { spawnSync } from "node:child_process" ;
18 import semver from "semver" ;
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/lib/mesh/live/daemon/install.js View on unpkg · L7 19 import { atomicWrite } from "../../../index-render/shared.js" ;
20 import { resolveDaemonAssetDir } from "./log.js" ;
21 import { LAUNCHD_LABEL, SYSTEMD_UNIT_NAME, WINDOWS_TASK_NAME, daemonDir, daemonLogPath, daemonPidPath, } from "./paths.js" ;
22 import { isInstallableHqRoot, readDaemonConfig, registerTrustedHqRoot, verifyHqRoot } from "./config.js" ;
23 import { defaultPidLockDeps, pidLockStatus, readPidLock } from "./pid-lock.js" ;
24 import { retireLegacyListen } from "./legacy-listen.js" ;
25 import { readDaemonState } from "./state.js" ;
26 import { activateLaunchd, defaultRunCommand, discoverLaunchdIdentity, installLaunchdPlist, launchdProgramArguments, launchdIsLoaded, launchdServiceTarget, launchdPlistProgramArguments, parseLaunchdCommand, launchdProgramArgumentsDiffer, parseLaunchctlPrintArguments, } from "../../../service-manager/launchd.js" ;
27 import { activateSystemd, systemdIsActive } from "../../../service-manager/systemd.js" ;
7 Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/main.js -> dist/utils/self-update.js -> [redacted].js
L7: * - Windows: per-user Scheduled Task ai.getindigo.hq-mesh-daemon registered
L8: * from a rendered task XML via schtasks.exe (no native dependencies)
L9: *
...
L16: import * as path from "node:path";
L17: import { spawnSync } from "node:child_process";
L18: import semver from "semver";
...
L54: status: r.status,
L55: stdout: r.stdout ?? "",
L56: stderr: r.error ? r.error.message : (r.stderr ?? ""),
...
L62: const raw = readFileSync(file);
L63: const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(String(raw));
L64: if ((buf.length >= 2 && buf[0] === 0xff && buf[1] === 0xfe) || buf.includes(0)) {
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/lib/mesh/live/daemon/install.js View on unpkg · L7 • matchType = normalized_sha256
matchedPackage = @indigoai-us/hq-cli@5.345.145
matchedPath = [redacted].js
matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/lib/mesh/live/daemon/install.js View on unpkg