registry / Install hook abuse / bumper-guard

bumper-guard

A plain-language safety net for vibe coders. Pauses risky things your AI assistant (Claude Code, Cursor, Copilot CLI) is about to do, explains them in plain English, and lets you decide.

This report shows the evidence for bumper-guard@0.2.13. 12 of 12 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic lifecycle chain modifies foreign global AI-agent configurations and establishes persistent background execution. This meets the install-hook abuse blocking policy even though direct external exfiltration of hook data was not found.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

The package intercepts AI-agent tool activity and persists a daemon without an explicit setup command.

Mechanism

automatic AI-agent hook injection plus login persistence

Attack narrative

On installation, the postinstall script detects AI-agent directories and silently adds global hooks that invoke package code before tool actions. It then starts a detached daemon and installs a per-user login service. The hooks forward commands, paths, and content to that daemon, which writes request records to a home-directory audit log. This is unconsented postinstall mutation of broad AI-agent control surfaces combined with persistence.

AI rationale

Evidence

package.jsonsrc/installers/postinstall.jssrc/installers/claude-code.jssrc/installers/cursor.jssrc/installers/autostart.jssrc/daemon.js~/.claude/settings.json~/.cursor/hooks.json~/.copilot/hooks/bumper.json~/Library/LaunchAgents/com.bumper.autostart.plist~/.config/systemd/user/bumper.serviceWindows Startup/BumperAutostart.vbs~/.bumper/audit.jsonl

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The postinstall hook automatically detects installed AI tools, globally wires their hook configurations, starts a detached daemon, and enables login persistence.
Global Claude Code integration appends a command hook for every pre-tool action to the user's settings file.
Global Cursor integration adds shell and MCP hooks to the user's Cursor configuration.
The install path creates operating-system login persistence through launchd, systemd, or the Windows Startup folder.
The daemon records complete hook requests, including commands, file paths, and content, in a user-home audit log.

Evidence against

No runtime dependency on another release of this package was found.
The only external service code inspected is account and quota traffic; no direct remote upload of captured hook requests was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

2 "name": "bumper-guard",

3 "version": "0.2.13",

4 "description": "A plain-language safety net for vibe coders. Pauses risky things your AI assistant (Claude Code, Cursor, Copilot CLI) is about to do, explains them in plain English, and lets you decide.",

5 "bin": {

6 "bumper": "bin/bumper.js"

7 },

8 "main": "src/daemon.js",

9 "type": "commonjs",

10 "files": [

11 "bin",

12 "src",

13 "bumper.policy.example.yaml",

14 "README.md",

15 "LICENSE"

16 ],

17 "scripts": {

18 "start": "node bin/bumper.js start",

19 "postinstall": "node src/installers/postinstall.js || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 },

21 "dependencies": {

22 "@modelcontextprotocol/sdk": "^1.12.0",

23 "commander": "^12.1.0",

24 "express": "^4.21.2",

25 "js-yaml": "^4.1.0",

26 "zod": "^3.23.8"

27 },

28 "engines": {

29 "node": ">=18"

30 },

31 "license": "SEE LICENSE IN LICENSE",

32 "homepage": "https://bumper-guard.pages.dev"

33}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/installers/autostart.jsView file

Lines 1-23javascript

1const fs = require("fs");

2const os = require("os");

3const path = require

bin/bumper.jsView file

•matchType = token_shingles matchedPackage = bumper-guard@0.2.12 matchedPath = bin/bumper.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bumper.jsView on unpkg

src/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.12 matchedPath = src/daemon.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/daemon.jsView on unpkg

src/account.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.12 matchedPath = src/account.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/account.jsView on unpkg

src/policy.jsView file

•matchType = normalized_sha256 matchedPackage = bumper-guard@0.2.12 matchedPath = src/policy.js matchedIdentity = npm:YnVtcGVyLWd1YXJk:0.2.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/policy.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/installers/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node src/installers/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/installers/autostart.jsView file

Findings

8 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Persistencesrc/installers/autostart.js

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similaritybin/bumper.js

HighKnown Malware Source Similaritysrc/installers/autostart.js

HighKnown Malware Source Similaritysrc/daemon.js

HighKnown Malware Source Similaritysrc/account.js

HighKnown Malware Source Similaritysrc/policy.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/installers/autostart.js

Affected versions and remediation

This report applies to bumper-guard@0.2.13.

The versions list below shows the verdict for each recorded version.

Avoid installing bumper-guard@0.2.13. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-01 14:14:35.769Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

12 known versions

0.2.13latestshownMaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 2:11 PM 0.2.12MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 10:29 AM 0.2.11MaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 9:58 AM 0.2.10MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 31, 2026, 4:39 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Source & flagged code

Related packages

Other install hook abuse packages