registry / Credential exfiltration / @metaphi-ai/hum / 0.2.62

@metaphi-ai/hum@0.2.62

Hum: a self-improving coding agent for your terminal.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The lifecycle installer appears scoped to installing Hum’s own Python core. The runtime reporter’s configurable destination can receive a saved service token, so this warrants a warning for conditional credential exposure.

Static reason

One or more suspicious static signals were detected.

Trigger

Interactive startup or completion of a CLI command when a pending diagnostic exists.

Impact

A custom destination can receive the service token along with diagnostics. The source shows conditional exposure, not how a recipient would use the token.

Mechanism

The reporter uses HUM_AUTH_URL or credentials.json auth_url without a source-level host allowlist, then includes the saved access token as a bearer header.

AI rationale

Evidence

dist/cli.mjscredentials.jsonhealth.json

Network endpoints1

hum.metaphi.ai

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package postinstall hook runs scripts/postinstall.js, which calls installCore when its matching core is missing.
The health reporter takes its destination from HUM_AUTH_URL or credentials.json auth_url, with https://hum.metaphi.ai as the fallback.
The reporter reads credentials.json access_token and sends it as a bearer token with a POST to the health endpoint.
Pending reports are sent automatically during interactive startup and after CLI commands.

Evidence against

The install hook installs the matching hum-cli Python core; the inspected lifecycle path does not establish broad consumer-project mutation.
The default health destination is the Hum service host.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

9 flagged

package.jsonView file

Lines 1-13json

2 "name": "@metaphi-ai/hum",

3 "version": "0.2.62",

4 "description": "Hum: a self-improving coding agent for your terminal.",

5 "license": "UNLICENSED",

6 "type": "module",

7 "bin": { "hum": "bin/hum.js" },

8 "files": ["bin", "dist", "scripts"],

9 "scripts": { "postinstall": "node scripts/postinstall.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "engines": { "node": ">=22" },

11 "repository": { "type": "git", "url": "git+https://github.com/metaphi-labs/hum.git" }

12}

dist/install.mjsView file

Lines 1-21javascript

1// src/install.js

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

4import os from "node:os";

dist/install.mjs#virtual:normalized:round1View file

95fs.mkdirSync(path.dirname(dir), { recursive: true }); L96: const r = runImpl("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script]); L97: try {

High

Shell

Package source references shell execution.

dist/install.mjs#virtual:normalized:round1View on unpkg · L95

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/install.mjs#virtual:normalized:round1View on unpkg

bin/hum.jsView file

Lines 5-30javascript

5// it over localhost. Everything the person sees is there; everything the session records is in

6// the core. This file is what npm put on PATH and it changes only when npm reinstalls it: keep

7// it small, and keep it running whatever the versions directory holds.

8import fs from 'node:fs';

9import { fileURLToPath, pathToFileURL } from 'node:url';

10import path from

dist/cli.mjsView file

•path = dist/cli.mjs kind = oversized_source_file sizeBytes = 4214104 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.mjsView on unpkg

•path = dist/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 4214104 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.mjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.mjsView file

1// src/install.js L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

Findings

5 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/install.mjs

HighShelldist/install.mjs#virtual:normalized:round1

HighCross File Remote Execution Contextdist/install.mjs

HighSemantic Analysis Limiteddist/install.mjs#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumEnvironment Vars

MediumOversized Source Filedist/cli.mjs

MediumOversized Cli Entrypointdist/cli.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.2.62.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.2.62 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 09:15:12.717Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.