Loading npm security reports…

haansi@0.1.36: Malicious npm security report (Block) | LPM Firewall

registry / haansi / 0.1.36

haansi@0.1.36

Haansi CLI - Session collector and MCP server for Claude Code & OpenAI Codex

AI Security Review

scanned 27d ago · by lpm-firewall-ai

The package uploads local Claude Code and Codex session contents to api.haansi.co. An MCP configuration causes collection to begin automatically whenever the configured server starts.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running haansi setup-mcp and then starting Codex or Claude Code; the separate setup-daemon command also persists scheduled collection.

Impact

Coding prompts, tool outputs, and associated git metadata can be sent to the remote service using the local Haansi token.

Mechanism

Agent-session harvesting, remote upload, MCP startup collection, and optional launchd persistence.

Attack narrative

The CLI reads local coding-agent session logs and uploads their contents to the Haansi API. Although installation itself has no lifecycle hook, its MCP setup registers a server in the agent configuration. When that server starts, its warmup routine silently invokes collection in the background, so normal agent startup can trigger session exfiltration without a separate collect command. A separate command can also install a login-start launchd daemon that repeatedly runs collection.

AI rationale

This is concrete data exfiltration from AI-agent session stores, coupled to automatic MCP-server startup collection and optional persistence. The absence of an install hook reduces installation-time risk but does not remove the runtime exfiltration path.

Evidence

dist/haansi.js$CODEX_HOME/sessions/**/rollout-*.jsonl~/.claude/projects/**/*.jsonl$CODEX_HOME/config.toml~/Library/LaunchAgents/co.haansi.daemon.plist~/.haansi/credentials.json

Source & flagged code

7 flagged · loading source

dist/haansi.jsView file

41SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/haansi.jsView on unpkg · L41

•Trigger-reachable chain: manifest.bin -> dist/haansi.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/haansi.jsView on unpkg

70try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

High

Child Process

Package source references child process execution.

dist/haansi.jsView on unpkg · L70

41Detached bundled service listener: dist/haansi.js launches a Node helper and exposes a broad-bound HTTP listener. L41: SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/haansi.jsView on unpkg · L41

41Trigger-reachable persistence chain: manifest.bin -> dist/haansi.js L41: SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/haansi.jsView on unpkg · L41

41SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/haansi.jsView on unpkg · L41

41SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/haansi.jsView on unpkg · L41

Source & flagged code

7 flagged

dist/haansi.jsView file

41SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/haansi.jsView on unpkg · L41

•Trigger-reachable chain: manifest.bin -> dist/haansi.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/haansi.jsView on unpkg

70try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

High

Child Process

Package source references child process execution.

dist/haansi.jsView on unpkg · L70

41Detached bundled service listener: dist/haansi.js launches a Node helper and exposes a broad-bound HTTP listener. L41: SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/haansi.jsView on unpkg · L41

41Trigger-reachable persistence chain: manifest.bin -> dist/haansi.js L41: SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/haansi.jsView on unpkg · L41

41SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/haansi.jsView on unpkg · L41

41SERVICE_URL_DEFAULTS = Object.freeze({ L42: haansiApiBaseUrl: "https://api.haansi.co", L43: localApiBaseUrl: "http://localhost:3000", ... L55: function apiUrl() { L56: return process.env.HAANSI_API_URL ?? DEFAULT_API_URL; L57: } ... L61: try { L62: const creds = JSON.parse((0, import_node_fs.readFileSync)(CREDENTIALS_FILE, "utf-8")); L63: if (typeof creds.token === "string" && creds.token) return creds.token; ... L70: try { L71: const binPath = (0, import_node_child_process.execSync)("which haansi", { encoding: "utf-8" }).trim(); L72: if (binPath) return binPath;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/haansi.jsView on unpkg · L41