@metaphi-ai/hum@0.2.17

Hum: a self-improving coding agent for your terminal.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The postinstall hook performs network-backed setup, but the inspected code installs the package’s own versioned core and disables scripts for its secondary npm fetch. The credential-related code reads Hum’s own credentials file for diagnostics, and no browser credential harvesting or transmission was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Package installation runs postinstall; CLI behavior begins when a user launches hum interactively.

Impact

No malicious effect was established from the inspected source.

Mechanism

The installer provisions a versioned Python environment and Hum core. Inspected credential handling reads Hum’s local credentials file for a diagnostic status check; no browser credential collection or exfiltration was found.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/install.mjsdist/cli.mjs

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The postinstall hook runs the installer only when this version of the package’s core is missing.
The installer provisions a versioned Python environment and fetches the package’s matching core; its secondary npm fetch uses --ignore-scripts.
The CLI requires an interactive terminal and starts a local core session.
The credential read is from Hum’s own credentials file in a diagnostic check; no browser credential collection or transmission was found.

Evidence against

The postinstall hook performs network-backed installation and invokes shell commands to install uv.
The CLI reads Hum’s local credentials file during diagnostics.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 3 file(s), 271 KB of source, external domains: astral.sh, github.com, react.dev

Source & flagged code

9 flagged

package.jsonView file

Lines 1-13json

2 "name": "@metaphi-ai/hum",

3 "version": "0.2.17",

4 "description": "Hum: a self-improving coding agent for your terminal.",

5 "license": "UNLICENSED",

6 "type": "module",

7 "bin": { "hum": "bin/hum.js" },

8 "files": ["bin", "dist", "scripts"],

9 "scripts": { "postinstall": "node scripts/postinstall.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "engines": { "node": ">=22" },

11 "repository": { "type": "git", "url": "git+https://github.com/metaphi-labs/hum.git" }

12}

dist/install.mjsView file

Lines 1-21javascript

1// src/install.js

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

4import os from "node:os";

bin/hum.jsView file

Lines 5-30javascript

5// it over localhost. Everything the person sees is there; everything the session records is in

6// the core. This file is what npm put on PATH and it changes only when npm reinstalls it: keep

7// it small, and keep it running whatever the versions directory holds.

8import fs from 'node:fs';

9import { fileURLToPath, pathToFileURL } from 'node:url';

10import path from

dist/cli.mjsView file

485"use strict"; L486: "production" !== process.env.NODE_ENV && (function() { L487: function defineDeprecationWarning(methodName, info) { ... L624: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L625: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L626: displayName ... L1664: cwdFunction = isBrowser ? () => { L1665: throw new Error("`process.cwd()` only works in Node.js, not the browser."); L1666: } : process2.cwd; ... L1768: } L1769: const imageBuffer = Buffer.from(data); L1770: return wrapOsc(returnValue + `;size=${imageBuffer.byteLength}:` + imageBuffer.toString("base64") + BEL);

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.mjsView on unpkg · L485

88872import fs5 from "node:fs"; L88873: import net from "node:net"; L88874: import os5 from "node:os"; ... L88876: import crypto from "node:crypto"; L88877: import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process"; L88878: function uvToolDirs() { L88879: const dirs = []; L88880: if (process.env.UV_TOOL_DIR) dirs.push(process.env.UV_TOOL_DIR); L88881: if (win3) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L88872

4648import process3 from "node:process"; L4649: import { execFileSync } from "node:child_process"; L4650: import fs from "node:fs"; ... L4705: try { L4706: const statContents = fs.readFileSync("/proc/self/stat", "utf8"); L4707: const closingParenthesisIndex = statContents.lastIndexOf(") "); ... L71088: /* metaparameters */ L71089: "alias audit before loglevel noop require subscribe tag owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_diff type_check e... L71090: ),

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.mjsView file

1// src/install.js L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

Findings

1 Critical6 High4 Medium5 Low

CriticalBrowser Credential Phishingdist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/install.mjs

HighShelldist/install.mjs

HighSame File Env Network Executiondist/cli.mjs

HighRemote Agent Bridgedist/cli.mjs

HighKnown Malware Source Similaritydist/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Low

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.2.17.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.2.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 06:53:45.451Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.