@metaphi-ai/hum@0.2.8
Hum: a self-improving coding agent for your terminal.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes unconsented install-time remote code execution and a later automatic remote-update path. It does not establish credential theft, destructive behavior, or broad AI-agent-control-surface mutation, so this is suspicious rather than proven malicious.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation triggers postinstall; later CLI use can trigger an automatic update.
Impact
A compromised or substituted remote installer or downstream Python package can execute code as the installing user.
Mechanism
Remote shell bootstrap and background remote installer execution.
AI rationale
The source establishes unconsented install-time remote code execution and a later automatic remote-update path. It does not establish credential theft, destructive behavior, or broad AI-agent-control-surface mutation, so this is suspicious rather than proven malicious.
Evidence
package.jsonscripts/postinstall.jsdist/install.mjsdist/cli.mjs~/.hum/core~/.hum/core-install.json~/.hum/update.json~/.local/bin
Network endpoints3
astral.sh/uv/install.ps1astral.sh/uv/install.shhumboldt.metaphi.ai
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package has an automatic postinstall hook.
- The postinstall loader imports installer code at install time.
- The installer pipes a remote script into a shell, including a PowerShell execution-policy bypass.
- The installer creates a Python environment and installs a remote hum-cli package.
- The CLI can launch an unattended background updater that runs a remotely downloaded installer.
Evidence against
- The visible installer writes its state and core under the package-owned ~/.hum directory.
- No shipped source code was found harvesting browser credentials or transmitting local secrets.
- No source writes AI-agent configuration or consumer project files.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Oversized source lightweight scan
dist/cli.mjs3.94 MB file, sampled 256 KB
FilesystemChildProcessEnvironmentVarsShellHighEntropyStringsUrlStringsgithub.comreact.dev
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/install.mjsView file
1// src/install.js
L2: import { spawnSync } from "node:child_process";
L3: import fs from "node:fs";
High
88say("installing uv (it creates the Python environment for the part of hum that does the work) \u2026");
L89: const r = win ? runImpl("powershell", ["-ExecutionPolicy", "ByPass", "-c", "irm https://astral.sh/uv/install.ps1 | iex"], { stdio: "inherit" }) : runImpl("sh", ["-c", "curl -LsSf h...
L90: u = r && r.status === 0 ? uv() : null;
High
•matchType = normalized_sha256
matchedPackage = @metaphi-ai/hum@0.2.7
matchedPath = dist/install.mjs
matchedIdentity = npm:QG1ldGFwaGktYWkvaHVt:0.2.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/install.mjsView on unpkgbin/hum.jsView file
17// a URL, not a path: on Windows `C:\…` is not something the ESM loader will import
L18: await import(pathToFileURL(path.join(here, '..', 'dist', 'cli.mjs')).href);
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/hum.jsView on unpkg · L17dist/cli.mjsView file
485"use strict";
L486: "production" !== process.env.NODE_ENV && (function() {
L487: function defineDeprecationWarning(methodName, info) {
...
L624: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error(
L625: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di...
L626: displayName
...
L1664: cwdFunction = isBrowser ? () => {
L1665: throw new Error("`process.cwd()` only works in Node.js, not the browser.");
L1666: } : process2.cwd;
...
L1768: }
L1769: const imageBuffer = Buffer.from(data);
L1770: return wrapOsc(returnValue + `;size=${imageBuffer.byteLength}:` + imageBuffer.toString("base64") + BEL);
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
dist/cli.mjsView on unpkg · L48588734import fs5 from "node:fs";
L88735: import net from "node:net";
L88736: import os5 from "node:os";
...
L88738: import crypto from "node:crypto";
L88739: import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
L88740: function uvToolDirs() {
L88741: const dirs = [];
L88742: if (process.env.UV_TOOL_DIR) dirs.push(process.env.UV_TOOL_DIR);
L88743: if (win3) {
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.mjsView on unpkg · L887344648import process3 from "node:process";
L4649: import { execFileSync } from "node:child_process";
L4650: import fs from "node:fs";
...
L4705: try {
L4706: const statContents = fs.readFileSync("/proc/self/stat", "utf8");
L4707: const closingParenthesisIndex = statContents.lastIndexOf(") ");
...
L71088: /* metaparameters */
L71089: "alias audit before loglevel noop require subscribe tag owner ensure group mode name|0 changes context force incl lens load_path onlyif provider returns root show_diff type_check e...
L71090: ),
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/cli.mjsView on unpkg · L4648•matchType = normalized_sha256
matchedPackage = @metaphi-ai/hum@0.2.7
matchedPath = dist/cli.mjs
matchedIdentity = npm:QG1ldGFwaGktYWkvaHVt:0.2.7
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/cli.mjsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = aade354ffc83685a
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @metaphi-ai/hum@0.2.7
matchedPath = dist/cli.mjs
matchedIdentity = npm:QG1ldGFwaGktYWkvaHVt:0.2.7
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/cli.mjsView on unpkgFindings
1 Critical8 High4 Medium5 Low
CriticalBrowser Credential Phishingdist/cli.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/install.mjs
HighShelldist/install.mjs
HighSame File Env Network Executiondist/cli.mjs
HighRemote Agent Bridgedist/cli.mjs
HighKnown Malware Source Similaritydist/cli.mjs
HighKnown Malware Source Similaritydist/install.mjs
HighKnown Malware Source Fingerprint Signaturedist/cli.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/hum.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @metaphi-ai/hum@0.2.8.
See all versions of @metaphi-ai/hum for other recorded verdicts.
- Review the evidence and your use of @metaphi-ai/hum@0.2.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.