registry / helper-agent / 1.0.1
helper-agent@1.0.1
Authorized HTB dependency-resolution canary
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe automatic install-time webhook beacon is a real, unexplained network behavior and warrants a warning. The inspected request sends only a fixed marker, so the source does not establish data theft or another publish-blocking attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the postinstall hook.
Impact
The endpoint receives an installation beacon; no consumer secrets or files are sent in the inspected source.
Mechanism
The hook launches probe.cjs, which sends an HTTPS POST with a fixed text body to webhook.site.
AI rationale
The automatic install-time webhook beacon is a real, unexplained network behavior and warrants a warning. The inspected request sends only a fixed marker, so the source does not establish data theft or another publish-blocking attack.
Evidence
package.jsonprobe.cjs
Network endpoints1
webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs probe.cjs automatically from its postinstall hook.
- The probe sends an HTTPS POST to a webhook.site endpoint during installation.
- The POST body is a fixed canary marker; inspected source shows no credential or file collection.
Evidence against
- The request body is a fixed marker rather than harvested consumer data.
- The inspected package contains only package.json and probe.cjs, with no additional payload or persistence code.
Behavioral surface
Network
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node probe.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"scripts": {
"postinstall": "node probe.cjs"
},
"l
Medium
Suspicious Lifecycle Evidence
The package runs probe.cjs automatically from its postinstall hook.
package.jsonView on unpkg · L5probe.cjsView file
3const url = "https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481";
const req = https.request(url, {
method: "POST",
headers: { "Content-Type": "text/plain" },
timeout: 10000
}, res => res.resume());
req.on(
Medium
Ai Review Evidence
The probe sends an HTTPS POST to a webhook.site endpoint during installation.
probe.cjsView on unpkg · L3Findings
1 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceprobe.cjs
MediumAi Review Evidenceprobe.cjs
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to helper-agent@1.0.1.
See all versions of helper-agent for other recorded verdicts.
- Review the evidence and your use of helper-agent@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.