registry / @indigoai-us/hq-cli / 5.345.150

@indigoai-us/hq-cli@5.345.150

⚠ Under review

HQ by Indigo management CLI — modules and cloud sync

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The inspected postinstall behavior and credential requests appear consistent with the package’s native hook setup and Claude capacity collection. I could not certify the package clean because a required source file was unreadable.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package invokes its postinstall hook; the runtime capacity scheduler can invoke the Claude OAuth collector.

Impact

No malicious effect was confirmed in the inspected paths; the unreadable required file prevents a clean determination.

Mechanism

The postinstall script attempts to install the package’s native hook engine. The inspected collector uses Claude credentials for Anthropic OAuth requests.

AI rationale

Evidence

dist/lib/search-index/index.jspackage.jsonscripts/install-hook-engine.mjsdist/lib/capacity/collectors/claude-oauth.js

Network endpoints2

api.anthropic.com/api/oauth/usageconsole.anthropic.com/v1/oauth/token

Decision evidence

public snapshot

AI called this Manual Review at 67.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest’s postinstall hook invokes a first-party native hook-engine installer.
The Claude OAuth collector normally requires an enabled collector mark; its scheduler sends bearer authentication to Anthropic’s OAuth usage endpoint.
The inspected credential refresh path posts to Anthropic’s token endpoint.

Evidence against

The required source file dist/lib/search-index/index.js could not be read because it contains binary or unapproved NUL data, so the clean review remains incomplete.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 996 file(s), 13.8 MB of source, external domains: 127.0.0.1, a.co, api.anthropic.com, api.github.com, api.indigo-hq.com, api.openai.com, api.slack.com, cli-chat-proxy.grok.com, console.anthropic.com, docs.hq.computer, example.com, github.com, gmailmcp.googleapis.com, hq.computer, hq.getindigo.ai, hq.indigo.ai, hqapi.hq.computer, json-schema.org, nodejs.org, onboarding.hq.computer, registry.npmjs.org, schemas.microsoft.com, www.apple.com

Source & flagged code

29 flagged

package.jsonView file

Lines 25-65json

25 "scripts/install-hook-engine.mjs",

26 "scripts/hook-engine-manifest.mjs"

27 ],

28 "scripts": {

29 "build": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs && tsc && node scripts/generate-command-catalog.mjs --check && node scripts/copy-schemas.mjs && node scripts/chmod-bins.mjs && node scripts/bundle-sync-runner.mjs",

30 "prepublishOnly": "npm run build",

31 "pretypecheck": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",

32 "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.typetest.json",

33 "gen:scan-golden": "node scripts/generate-scan-packages-table.mjs > src/utils/__fixtures__/scan-packages.generated-block.sh",

34 "gen:command-catalog": "tsc && node scripts/generate-command-catalog.mjs",

35 "lint": "eslint .",

36 "pretest": "node scripts/generate-dsn.mjs && node scripts/build-flag-registry-worker.mjs",

37 "test": "vitest run",

38 "gen:hq-mcp-tools": "node scripts/generate-hq-mcp-tools.mjs",

39 "test:db": "vitest run src/lib/db test/commands/db.test.ts test/commands/db-tenant-isolation.test.ts",

40 "test:e2e": "vitest run --config vitest.e2e.config.ts",

41 "coverage": "vitest run --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary",

42 "check:lanes-module-cycles": "node scripts/check-lanes-module-cycles.mjs",

43 "vitest": "vitest",

44 "clean": "rm -rf dist",

45 "postinstall": "node scripts/install-hook-engine.mjs || node -e \"process.exit(0)\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L45

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

46 "prepare": "husky || true",

47 "check:no-hermes": "bash scripts/check-no-hermes.sh",

48 "prepack": "node scripts/hook-engine-manifest.mjs",

49 "postpublish": "node scripts/hook-engine-manifest.mjs restore"

50 },

51 "dependencies": {

52 "@aws-sdk/client-iot-data-plane": "^3.1096.0",

53 "@aws-sdk/client-s3": "^3.1049.0",

54 "@aws-sdk/dsql-signer": "^3.1146.0",

55 "@indigoai-us/hq-cloud": "~6.18.90",

56 "@indigoai-us/hq-flags-client": "^0.1.2",

57 "@modelcontextprotocol/sdk": "1.29.0",

58 "@sentry/node": "^10.49.0",

59 "@tobilu/qmd": "2.5.3",

60 "ajv": "^8.20.0",

61 "better-sqlite3": "^12.11.1",

62 "chalk": "^5.3.0",

63 "commander": "^12.1.0",

64 "js-yaml": "^4.1.0",

65 "mqtt": "5.15.2",

dist/startup-registration.jsView file

Lines 1-38javascript

1/**

2 * The command-registration recovery seam for the "install tree torn out from

3 * under a starting `hq`" condition (Sentry HQ-CLI-1G/1H/1J/1K).

4 *

5 * `runCli` registers commands as its last step before `program.parseAsync()` —

6 * the lazy command import or `import("./register-all.js")` and everything those

7 * pull in. That is the ONE place a module-resolution failure is provably safe to

8 * recover from: it is inside hq-cli's own graph, it runs before `parseAsync` and

9 * before the preAction hook, so no command action, telemetry, or stdin read has

dist/utils/staged-install.jsView file

Lines 316-346javascript

316 if (result.status !== 0)

317 return null;

318 const lines = (result.stdout ?? "").trim().

dist/utils/update-command-supervisor.cjsView file

Lines 1-22javascript

1"use strict";

3const { spawn: nativeSpawn } = require("node:child_process");

4const fs = require("node:fs");

dist/lib/daemon/sync-runner.jsView file

Lines 1-22javascript

1/** Local status and resource controls shared by the daemon and its sync runner. */

2import * as crypto from "node:crypto";

3import { spawnSync } from "node:child_process";

4import * as fs

dist/lib/mesh/live/daemon/install.jsView file

Lines 1-27javascript

1/**

2 * User-level service install for hq mesh daemon.

3 *

4 * - macOS: LaunchAgent ai.getindigo.hq-mesh-daemon

5 * - Linux: systemd user unit hq-mesh-daemon.service

6 * (documented fallback: root-owned unit running as ec2-user)

7 * - Windows: per-user Scheduled Task ai.getindigo.hq-mesh-daemon registered

8 * from a rendered task XML via schtasks.exe (no native dependencies)

9 *

10 * The unit embeds the hq binary resolved at install time. Logs go to

dist/commands/rescue.js#virtual:normalized:round1View file

1import { spawnSync } from "child_process"; L2: import * as fs from "fs"; ... L11: /** L12: * Resolve the source repo + ref from the user"s flags. Pure + exported for\n * tests. `latestTag` is the resolved latest release tag (prod only); ignored\n * for staging and when a... L13: if (!ref) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/rescue.js#virtual:normalized:round1View on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/rescue.js#virtual:normalized:round1View on unpkg · L1

dist/lib/capacity/collectors/claude-oauth.jsView file

6* or the credentials JSON under ~/.claude/ on Linux). GETs L7: * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta L8: * header. This module does not invoke the claude CLI except ... L31: */ L32: import { execFile, spawnSync } from "node:child_process"; L33: import * as crypto from "node:crypto"; ... L81: } L82: export function defaultClaudeCredentialsPath(home = os.homedir()) { L83: return path.join(home, ".claude", ".credentials.json"); ... L279: retryAfter = response.headers?.get("retry-after") ?? null; L280: text = status === 200 ? await response.text() : ""; L281: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/lib/capacity/collectors/claude-oauth.jsView on unpkg · L6

dist/lib/lanes/machine-identity.jsView file

11*/ L12: import { spawnSync } from "node:child_process"; L13: import * as os from "node:os"; L14: export const IMDS_HOST = "169.254.169.254"; L15: export const IMDS_TOKEN_URL = `http://${IMDS_HOST}/latest/api/token`; L16: export const IMDS_INSTANCE_ID_URL = `http://${IMDS_HOST}/latest/meta-data/instance-id`; ... L30: return null; L31: const body = (result.stdout ?? "").trim(); L32: return body.length > 0 ? body : null; ... L34: catch (err) { L35: process.stderr.write(`hq lanes: IMDS request failed for ${url}: ${err instanceof Error ? err.message : String(err)}\n`); L36: return null;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/lib/lanes/machine-identity.jsView on unpkg · L11

assets/lanes-hooks/hq-lanes-drain.shView file

•path = assets/lanes-hooks/hq-lanes-drain.sh kind = build_helper sizeBytes = 620 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lanes-hooks/hq-lanes-drain.shView on unpkg

assets/scaffold/.claude/hooks/validate-policy-frontmatter.shView file

•path = assets/scaffold/.claude/hooks/validate-policy-frontmatter.sh kind = payload_in_excluded_dir sizeBytes = 21475 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/scaffold/.claude/hooks/validate-policy-frontmatter.shView on unpkg

dist/hq-cloud-sync-runner/bin/sync-runner.jsView file

•path = dist/hq-cloud-sync-runner/bin/sync-runner.js kind = oversized_source_file sizeBytes = 6220500 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/hq-cloud-sync-runner/bin/sync-runner.jsView on unpkg

•path = dist/hq-cloud-sync-runner/bin/sync-runner.js kind = oversized_cli_entrypoint sizeBytes = 6220500 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/hq-cloud-sync-runner/bin/sync-runner.jsView on unpkg

assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 47

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/scaffold/core/scripts/lib/codex-output-schema.mjs#virtual:normalized:round1View on unpkg

dist/commands/storage-offload.jsView file

•matchType = normalized_sha256 matchedPackage = @indigoai-us/hq-cli@5.345.145 matchedPath = dist/commands/storage-offload.js matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsaQ:5.345.145 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High