registry / Install hook abuse / @metaphi-ai/hum / 0.1.86

@metaphi-ai/hum@0.1.86

Hum: a self-improving coding agent for your terminal.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has a real install-time remote-code supply-chain surface, so it should warn. It does not meet the stated blocking condition because the inspected code is a transparent same-product installer confined to its own user-home area and has no self-dependency chain or confirmed theft.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

A remote installer and hum-cli release can execute with the installing user's permissions.

Mechanism

Remote shell bootstrap followed by Python package installation.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/install.mjs~/.hum/core~/.hum/core-install.json~/.local/bin

Network endpoints2

astral.sh/uv/install.ps1astral.sh/uv/install.sh

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

An npm postinstall automatically invokes the core installer.
When uv is absent, installation pipes a remote script into a shell with no integrity pinning.
The installer then installs the external hum-cli Python package into the user home directory.

Evidence against

The installed Python package is version-pinned to this package release by default.
The inspected code writes under ~/.hum and does not modify the consumer project or AI-agent configuration.
No browser credential harvesting or exfiltration logic was found in the inspected package source.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 3 file(s), 264 KB of source, external domains: astral.sh, github.com, reactjs.org

Oversized source lightweight scan

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.mjsView file

Lines 1-21javascript

1// src/install.js

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

6var win = process.platform === "win32";

7var npmFix = (version = "") => `npm i -g @metaphi-ai/hum@${version || "latest"} --foreground-scripts`;

8var NPM_FIX = npmFix("latest");

9var humHome = (env = process.env) => env.HUM_HOME || path.join(os.homedir(), ".hum");

10var coreDir = (env = process.env) => path.join(humHome(env), "core");

11var corePython = (env = process.env) => win ? path.join(coreDir(env), "Scripts", "python.exe") : path.join(coreDir(env), "bin", "python");

12var stampPath = (env) => path.join(coreDir(env), "version");

13var statePath = (env) => path.join(humHome(env), "core-install.json");

14var run = (cmd, args, opts = {}) => spawnSync(cmd, args, { encoding: "utf8", windowsHide: true, ...opts });

15var ASK_VERSION = ["-I", "-c", "import hum; print(hum.__version__)"];

16function importedVersion(env = process.env, runImpl = run) {

17 const r = runImpl(corePython(env), ASK_VERSION);

18 return r && r.status === 0 ? String(r.stdout).trim() : null;

19}

20function installedVersion(env = process.env, runImpl = run) {

21 try {

Lines 68-108javascript

68 return true;

69}

70function installCore(version, { env = process.env, say = (m) => console.log(`hum: ${m}`),

•matchType = normalized_sha256 matchedPackage = @metaphi-ai/hum@0.1.84 matchedPath = dist/install.mjs matchedIdentity = npm:QG1ldGFwaGktYWkvaHVt:0.1.84 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install.mjsView on unpkg

bin/hum.jsView file

8// a URL, not a path: on Windows `C:\…` is not something the ESM loader will import L9: await import(pathToFileURL(path.join(here, '..', 'dist', 'cli.mjs')).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hum.jsView on unpkg · L8

dist/cli.mjsView file

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2398: cwdFunction = isBrowser ? () => { L2399: throw new Error("`process.cwd()` only works in Node.js, not the browser."); L2400: } : process2.cwd; ... L2502: } L2503: const imageBuffer = Buffer.from(data); L2504: return wrapOsc(returnValue + `;size=${imageBuffer.byteLength}:` + imageBuffer.toString("base64") + BEL);

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.mjsView on unpkg · L317

83496import fs4 from "node:fs"; L83497: import net from "node:net"; L83498: import os5 from "node:os"; ... L83500: import crypto from "node:crypto"; L83501: import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process"; L83502: function uvToolDirs() { L83503: const dirs = []; L83504: if (process.env.UV_TOOL_DIR) dirs.push(process.env.UV_TOOL_DIR); L83505: if (win3) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L83496

32611if (filePath && origin?.line && fs.existsSync(filePath)) { L32612: const sourceCode = fs.readFileSync(filePath, "utf8"); L32613: excerpt = dist_default3(sourceCode, origin.line); ... L65850: /* metaparameters */ L65851: "alias audit before loglevel noop require subscribe tag owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_diff type_check e... L65852: ), ... L83192: // src/install.js L83193: import { spawnSync } from "node:child_process"; L83194: import fs2 from "node:fs";

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.mjsView file

1// src/install.js L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

Findings

1 Critical8 High4 Medium5 Low

CriticalBrowser Credential Phishingdist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/install.mjs

HighShelldist/install.mjs

HighSame File Env Network Executiondist/cli.mjs

HighRemote Agent Bridgedist/cli.mjs

HighKnown Malware Source Similaritydist/cli.mjs

HighKnown Malware Source Similaritydist/install.mjs

HighKnown Malware Source Fingerprint Signaturedist/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumEnvironment Vars

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.1.86.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.1.86 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 15:21:46.406Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.