registry / Remote code execution / @metaphi-ai/hum / 0.1.9

@metaphi-ai/hum@0.1.9

Hum (हम): a self-improving coding agent for your terminal.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Automatic download-and-shell execution during postinstall is a concrete supply-chain risk. The available source ties it to engine setup but does not establish malware intent or a broader attack chain.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation when uv is unavailable.

Impact

A registry installation can execute remotely supplied shell code and add software outside the npm package without an explicit user command.

Mechanism

The lifecycle hook invokes a PowerShell or curl-to-shell remote installer and then runs uv to install hum-cli.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/cli.mjs

Network endpoints2

astral.sh/uv/install.ps1astral.sh/uv/install.sh

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package declares an automatic postinstall hook.
The postinstall hook downloads and executes a remote installer through a shell pipeline when uv is absent.
The hook then installs the external hum-cli engine automatically.
The bundled CLI locates and runs the installed engine.

Evidence against

No credential collection or data-exfiltration behavior was identified in the inspected entrypoint and installer.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 3 file(s), 3.48 MB of source, external domains: astral.sh, github.com, reactjs.org, www.ibm.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

317"use strict"; L318: if (process.env.NODE_ENV !== "production") { L319: (function() { ... L545: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."], L546: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."] L547: }; ... L2209: ]; L2210: if (process.platform !== "win32") { L2211: module.exports.push( ... L2357: } L2358: process13.exitCode = code || /* istanbul ignore next */ L2359: 0;

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.mjsView on unpkg · L317

31298/** @param {string} s */ L31299: exec(s) { L31300: this.matcherRe.lastIndex = this.lastIndex;

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L31298

84522import fs3 from "node:fs"; L84523: import net from "node:net"; L84524: import os4 from "node:os"; ... L84526: import crypto from "node:crypto"; L84527: import { spawn, spawnSync } from "node:child_process"; L84528: var runDir = () => path2.join(process.env.HUM_HOME || path2.join(os4.homedir(), ".hum"), "run"); L84529: var readRun = (id) => {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L84522

57423/* metaparameters */ L57424: "alias audit before loglevel noop require subscribe tag owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_diff type_check e... L57425: ), ... L80422: if (filePath && origin?.line && fs.existsSync(filePath)) { L80423: const sourceCode = fs.readFileSync(filePath, "utf8"); L80424: excerpt = dist_default3(sourceCode, origin.line); ... L84526: import crypto from "node:crypto"; L84527: import { spawn, spawnSync } from "node:child_process"; L84528: var runDir = () => path2.join(process.env.HUM_HOME || path2.join(os4.homedir(), ".hum"), "run");

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.mjsView on unpkg · L57423

•matchType = normalized_sha256 matchedPackage = @metaphi-ai/hum@0.1.61 matchedPath = dist/cli.mjs matchedIdentity = npm:QG1ldGFwaGktYWkvaHVt:0.1.61 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.mjsView on unpkg

scripts/postinstall.jsView file

16const ok = process.platform === 'win32' L17: ? sh('powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"') L18: : sh('curl -LsSf https://astral.sh/uv/install.sh | sh');

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L16

2// Quiet when it already is; installs uv first when it is missing; never fails the npm install. L3: import { execSync, spawnSync } from 'node:child_process'; L4: import os from 'node:os'; ... L6: L7: const which = (cmd) => spawnSync(process.platform === 'win32' ? 'where' : 'which', [cmd], { stdio: 'ignore' }).status === 0; L8: const local = path.join(os.homedir(), '.local', 'bin'); L9: const sh = (cmd) => { try { execSync(cmd, { stdio: 'inherit', env: { ...process.env, PATH: `${local}${path.delimiter}${process.env.PATH || ''}` } }); return true; } catch { return ... L10: ... L16: const ok = process.platform === 'win32' L17: ? sh('powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"') L18: : sh('curl -LsSf https://astral.sh/uv/install.sh | sh');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.jsView on unpkg · L2

bin/hum.jsView file

8// a URL, not a path: on Windows `C:\…` is not something the ESM loader will import L9: await import(pathToFileURL(path.join(here, '..', 'dist', 'cli.mjs')).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hum.jsView on unpkg · L8

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

Critical

Findings

1 Critical7 High5 Medium6 Low

CriticalBrowser Credential Phishingdist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli.mjs

HighShellscripts/postinstall.js

HighSame File Env Network Executiondist/cli.mjs

HighSandbox Evasion Gated Capabilityscripts/postinstall.js

HighRemote Agent Bridgedist/cli.mjs

HighKnown Malware Source Similaritydist/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.1.9.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.1.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 00:17:17.155Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.