registry / helper-agent / 1.0.0
helper-agent@1.0.0
Authorized HTB dependency-resolution canary
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe automatic postinstall network request is a real, unexplained external beacon, so a warning is appropriate. The fixed body and absence of source evidence for sensitive-data collection do not support blocking as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall script.
Impact
It contacts an external endpoint during installation; no credential or file data is shown being sent.
Mechanism
The script sends a fixed text body to a webhook.site URL.
AI rationale
The automatic postinstall network request is a real, unexplained external beacon, so a warning is appropriate. The fixed body and absence of source evidence for sensitive-data collection do not support blocking as malware.
Evidence
package.jsonprobe.cjs
Network endpoints1
webhook.site
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json runs probe.cjs automatically during postinstall.
- probe.cjs sends a fixed canary string in a POST request to webhook.site.
- The package contains no other files; source does not show credential collection or a response-driven payload.
Evidence against
- The POST body is a fixed marker, not a value read from the environment or filesystem.
- The request has no response processing beyond consuming the response.
Behavioral surface
Network
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node probe.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"postinstall": "node probe.cjs"
},
"licen
Medium
Suspicious Lifecycle Evidence
package.json runs probe.cjs automatically during postinstall.
package.jsonView on unpkg · L6probe.cjsView file
3const url = "https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481";
const req = https.request(url, {
method: "POST",
Medium
Ai Review Evidence
probe.cjs sends a fixed canary string in a POST request to webhook.site.
probe.cjsView on unpkg · L314
Findings
1 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceprobe.cjs
MediumAi Review Evidenceprobe.cjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to helper-agent@1.0.0.
See all versions of helper-agent for other recorded verdicts.
- Review the evidence and your use of helper-agent@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.