registry / Install hook abuse / @metaphi-ai/hum / 0.1.4

@metaphi-ai/hum@0.1.4

Hum — हम. Human and model, one harness. A coding agent for your terminal.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The automatic lifecycle bootstrap is a real supply-chain risk because it executes downloaded installer content and installs another tool without a user command. The available source supports a warning rather than a block because no concrete malicious payload or exfiltration behavior was identified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall runs during package installation when hum-engine is unavailable.

Impact

A package install can make network-backed shell execution and persistent user-environment changes without an explicit setup command.

Mechanism

The lifecycle hook invokes a curl-to-shell or PowerShell-to-evaluator installer for uv, then uses uv to install hum-cli. The CLI subsequently executes hum-engine.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/cli.mjs

Network endpoints2

astral.sh/uv/install.ps1astral.sh/uv/install.sh

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json automatically runs scripts/postinstall.js after installation.
The postinstall hook downloads and pipes Astral's installer into a shell when uv is absent.
The hook then installs hum-cli through uv without an explicit user command.
The CLI launches the installed hum-engine command or a binary from the user's home directory.

Evidence against

The inspected CLI communicates with its engine over localhost; no package-side credential or data-exfiltration sink was identified.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 3 file(s), 3.45 MB of source, external domains: astral.sh, github.com, reactjs.org, www.ibm.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 1-13json

2 "name": "@metaphi-ai/hum",

3 "version": "0.1.4",

4 "description": "Hum — हम. Human and model, one harness. A coding agent for your terminal.",

5 "license": "UNLICENSED",

6 "type": "module",

7 "bin": { "hum": "bin/hum.js" },

8 "files": ["bin", "dist", "scripts"],

9 "scripts": { "postinstall": "node scripts/postinstall.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "engines": { "node": ">=18" },

11 "repository": { "type": "git", "url": "git+https://github.com/metaphi-labs/hum-cli.git" }

12}

dist/cli.mjsView file

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2209: ]; L2210: if (process.platform !== "win32") { L2211: module.exports.push( ... L2357: } L2358: process13.exitCode = code || /* istanbul ignore next */ L2359: 0;

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.mjsView on unpkg · L317

31298/** @param {string} s */ L31299: exec(s) { L31300: this.matcherRe.lastIndex = this.lastIndex;

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L31298

84166// src/engine.js L84167: import net from "node:net"; L84168: import { spawn } from "node:child_process"; L84169: var EngineError = class extends Error { ... L84171: var ENGINE_CANDIDATES = [ L84172: process.env.HUM_ENGINE, L84173: // explicit: a command to run

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L84166

scripts/postinstall.jsView file

Lines 1-24javascript

1// Make sure the engine is installed: `hum-engine` on PATH (uv tool install hum-cli).

2// Quiet when it already is; installs uv first when it is missing; never fails the npm install.

3import { execSync, spawnSync } from 'node:child_process';

4import os from 'node:os';

5import path from 'node:path';

bin/hum.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2// `hum` from npm: the Ink front-end, which starts Hum's engine (Python, installed by postinstall

3// via uv) and talks to it over localhost. Everything the person sees is here; everything the

4// session records is in the engine.

5import { fileURLToPath } from 'node:url';

6import path from 'node:path';

7const

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

Critical

Findings

1 Critical7 High5 Medium6 Low

CriticalBrowser Credential Phishingdist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli.mjs

HighShellscripts/postinstall.js

HighSame File Env Network Executiondist/cli.mjs

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighRemote Agent Bridgedist/cli.mjs

HighKnown Malware Source Similaritydist/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.1.4.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.1.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 00:17:11.577Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.