@metaphi-ai/hum@0.1.19

Hum (हम): a self-improving coding agent for your terminal.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The install-time network and process execution are used to bootstrap the matching Hum engine in its package-specific data directory. The flagged CLI update behavior does not start a background installer for npm installs, and the inspected source provides no evidence of credential theft or other concrete attack behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall hook; the CLI checks for updates when invoked.

Impact

The inspected behavior supports package setup and updates; no concrete attack surface was established.

Mechanism

The hook bootstraps uv and installs the matching engine under the Hum data directory. The update path returns a notice for npm installs instead of starting its native installer.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/cli.mjs

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares a postinstall hook that runs the package's own scripts/postinstall.js.
The postinstall script bootstraps uv if needed and installs the matching hum-cli version into the HUM_HOME/.hum engine environment.
The CLI selects the npm update path for Node execution; background installer execution is limited to native installs.
The inspected source shows no browser credential collection or unrelated credential transmission.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 260 KB of source, external domains: astral.sh, github.com, reactjs.org, storage.googleapis.com

Oversized source lightweight scan

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2209: ]; L2210: if (process.platform !== "win32") { L2211: module.exports.push( ... L2357: } L2358: process13.exitCode = code || /* istanbul ignore next */ L2359: 0;

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.mjsView on unpkg · L317

31298/** @param {string} s */ L31299: exec(s) { L31300: this.matcherRe.lastIndex = this.lastIndex;

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L31298

56858L56859: // node_modules/highlight.js/lib/languages/powershell.js L56860: var require_powershell = __commonJS({

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L56858

83597import path from "node:path"; L83598: import { spawn, spawnSync } from "node:child_process"; L83599: var dist = (env3 = process.env) => (env3.HUM_DIST || "https://storage.googleapis.com/hum-dist").replace(/\/+$/, ""); L83600: var humHome = (env3 = process.env) => env3.HUM_HOME || path.join(os3.homedir(), ".hum");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L83597

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L317

57423/* metaparameters */ L57424: "alias audit before loglevel noop require subscribe tag owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_diff type_check e... L57425: ), ... L80422: if (filePath && origin?.line && fs.existsSync(filePath)) { L80423: const sourceCode = fs.readFileSync(filePath, "utf8"); L80424: excerpt = dist_default3(sourceCode, origin.line); ... L83597: import path from "node:path"; L83598: import { spawn, spawnSync } from "node:child_process"; L83599: var dist = (env3 = process.env) => (env3.HUM_DIST || "https://storage.googleapis.com/hum-dist").replace(/\/+$/, "");

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L57423

•matchType = normalized_sha256 matchedPackage = @metaphi-ai/hum@0.1.61 matchedPath = dist/cli.mjs matchedIdentity = npm:QG1ldGFwaGktYWkvaHVt:0.1.61 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.mjsView on unpkg

bin/hum.jsView file

Lines 1-10javascript

1#!/usr/bin/env node

2// `hum` from npm: the Ink front-end, which starts Hum's engine (Python, installed by postinstall

3// via uv) and talks to it over localhost. Everything the person sees is here; everything the

4// session records is in the engine.

5import { fileURLToPath, pathToFileURL } from 'node:url';

6import path from 'node:path';

7const

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

Findings

1 Critical7 High4 Medium5 Low

CriticalBrowser Credential Phishingdist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighSame File Env Network Executiondist/cli.mjs

HighSandbox Evasion Gated Capabilitydist/cli.mjs

HighRemote Agent Bridgedist/cli.mjs

HighKnown Malware Source Similaritydist/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.1.19.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.1.19 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 06:55:06.955Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.