registry / @paulnsorensen/hallouminate-nightly / 0.0.0-experimental.51.1

@paulnsorensen/hallouminate-nightly@0.0.0-experimental.51.1

EXPERIMENTAL rolling build of paulnsorensen/hallouminate off main — NOT the official `hallouminate` package

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installation fetches and extracts a remotely hosted nightly binary; later CLI invocation executes it. The package version does not contain or pin the executable payload.

Static reason

One or more suspicious static signals were detected.

Trigger

`npm install` downloads the payload; invoking `hallouminate` executes it.

Impact

A mutable upstream release can change the executable code delivered for this immutable npm version.

Mechanism

postinstall remote binary staging followed by CLI binary execution

Rationale

The inspected JavaScript shows no direct theft, destructive action, or AI-agent control-surface mutation. However, this package installs and later executes a remotely mutable binary payload whose checksum is not independently pinned.

Evidence

package.jsoninstall.jsrun.jsbin/hallouminate

Network endpoints2

github.com/paulnsorensen/hallouminate/releases/download/nightly/hallouminate-${target}.tar.xzgithub.com/paulnsorensen/hallouminate/releases/download/nightly/hallouminate-${target}.tar.xz.sha256

Decision evidence

public snapshot

@paulnsorensen/hallouminate-nightly@0.0.0-experimental.51.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code