registry / Credential exfiltration / @metaphi-ai/hum / 0.2.64

@metaphi-ai/hum@0.2.64

Hum: a self-improving coding agent for your terminal.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The source shows a conditional transfer of a saved service token to an unrestricted configured endpoint, which warrants a warning. The default recipient is Hum's service, and no evidence establishes that an unrelated recipient was selected, so blocking is not supported.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs the CLI while a reportable install or core failure is pending, or a CLI startup fails.

Impact

If the selected URL is an unrelated host, that host can receive the saved Hum token and diagnostic metadata. The source does not establish that a custom URL is configured or that token exposure has occurred.

Mechanism

The report selects `HUM_AUTH_URL`, then the saved `auth_url`, then `https://hum.metaphi.ai`, and sends the saved access token as a bearer credential without a destination allowlist.

AI rationale

Evidence

dist/cli.mjsbin/hum.jspackage.jsonHUM_HOME/credentials.jsonHUM_HOME/health.jsonHUM_HOME/install-id

Network endpoints3

hum.metaphi.aiHUM_AUTH_URLcredentials.json auth_url

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm executable loads `dist/cli.mjs` as its active command entrypoint.
The CLI queues reports for recorded install failures, core failures, or startup errors, and calls the reporting path during CLI use.
The report reads a saved access token and uses `HUM_AUTH_URL` or the saved `auth_url` to select its destination, defaulting to `https://hum.metaphi.ai`.
The report sends failure diagnostics and the saved token in an HTTP request with a bearer authorization header.

Evidence against

The default report destination is Hum's service, and the report is limited to queued install or startup failures.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 3 file(s), 274 KB of source, external domains: api.nuget.org, astral.sh, github.com, hum.metaphi.ai, react.dev

Source & flagged code

9 flagged

package.jsonView file

Lines 1-13json

2 "name": "@metaphi-ai/hum",

3 "version": "0.2.64",

4 "description": "Hum: a self-improving coding agent for your terminal.",

5 "license": "UNLICENSED",

6 "type": "module",

7 "bin": { "hum": "bin/hum.js" },

8 "files": ["bin", "dist", "scripts"],

9 "scripts": { "postinstall": "node scripts/postinstall.js" },

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "engines": { "node": ">=22" },

11 "repository": { "type": "git", "url": "git+https://github.com/metaphi-labs/hum.git" }

12}

dist/install.mjsView file

Lines 1-21javascript

1// src/install.js

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

4import os from "node:os";

dist/install.mjs#virtual:normalized:round1View file

95fs.mkdirSync(path.dirname(dir), { recursive: true }); L96: const r = runImpl("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script]); L97: try {

High

Shell

Package source references shell execution.

dist/install.mjs#virtual:normalized:round1View on unpkg · L95

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/install.mjs#virtual:normalized:round1View on unpkg

bin/hum.jsView file

Lines 5-30javascript

5// it over localhost. Everything the person sees is there; everything the session records is in

6// the core. This file is what npm put on PATH and it changes only when npm reinstalls it: keep

7// it small, and keep it running whatever the versions directory holds.

8import fs from 'node:fs';

9import { fileURLToPath, pathToFileURL } from 'node:url';

10import path from

dist/cli.mjsView file

•path = dist/cli.mjs kind = oversized_source_file sizeBytes = 4215247 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.mjsView on unpkg

•path = dist/cli.mjs kind = oversized_cli_entrypoint sizeBytes = 4215247 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.mjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.mjsView file

1// src/install.js L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/install.mjsView on unpkg · L1

Findings

5 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/install.mjs

HighShelldist/install.mjs#virtual:normalized:round1

HighCross File Remote Execution Contextdist/install.mjs

HighSemantic Analysis Limiteddist/install.mjs#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/hum.js

MediumEnvironment Vars

MediumOversized Source Filedist/cli.mjs

MediumOversized Cli Entrypointdist/cli.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @metaphi-ai/hum@0.2.64.

See all versions of @metaphi-ai/hum for other recorded verdicts.

Review the evidence and your use of @metaphi-ai/hum@0.2.64 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 19:14:04.151Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.