registry / hitmaker / 2.1.2

hitmaker@2.1.2

Synthetic traffic generator for testing analytics, redirect, and click-tracking systems. Ships a prebuilt native binary with a Bubble Tea TUI and a headless CLI.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established in the inspected package source. The only executable behavior is a user-invoked CLI shim that starts a matching platform binary from a pinned optional dependency.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the `hitmaker` command.

Impact

Executes the separately packaged native CLI; the inspected JavaScript performs no install-time mutation, exfiltration, or networking.

Mechanism

Platform-binary resolution and argument-forwarding via `spawnSync`.

Rationale

The scanner findings reflect a normal native-CLI launcher, not runtime package installation or a concrete malicious chain. Direct inspection found no lifecycle execution, payload retrieval, credential access, persistence, or destructive behavior.

Evidence

package.jsonbin/hitmaker.jsREADME.md

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

`bin/hitmaker.js` launches a platform-specific optional-dependency binary when the user runs `hitmaker`.

Evidence against

`package.json` defines no preinstall, install, postinstall, prepare, or other lifecycle scripts.
`bin/hitmaker.js` only resolves a pinned `@zeb-link/hitmaker-*` package and forwards user arguments with inherited stdio.
No source reads credentials, environment secrets, or user files.
No runtime network client, shell command, eval, dynamic payload retrieval, persistence, or AI-agent configuration mutation is present.
The package contains only `package.json`, `README.md`, `LICENSE`, and the launcher shim.

Behavioral surface

Source

ChildProcess

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.97 KB of source, external domains: github.com

Source & flagged code

2 flagged

bin/hitmaker.jsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// Launcher for the hitmaker binary.

3//

4// The native binary ships in a per-platform package (@zeb-link/hitmaker-darwin-arm64

5// and friends) listed under optionalDependencies. npm installs only the one

6// matching the host, and this shim hands off to it with stdio inherited so the

7// Bubble Tea TUI keeps a real TTY.

9const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/hitmaker.jsView on unpkg · L8

11const PLATFORM_PACKAGES = {

12 "darwin arm64": "@zeb-link/hitmaker-darwin-arm64",

13 "darwin x64": "@zeb-link/hitmaker-darwin-x64",

14 "linux arm64": "@zeb-link/hitmaker-linux-arm64",

15 "linux x64": "@zeb-link/hitmaker-linux-x64",

16 "win32 arm64": "@zeb-link/hitmaker-win32-arm64",

17 "win32 x64": "@zeb-link/hitmaker-win32-x64",

18};

20function fail(message) {

21 console.error(`hitmaker: ${message}`);

22 process.exit(1);

23}

25function resolveBinary() {

26 const key = `${process.platform} ${process.arch}`;

27 const pkg = PLATFORM_PACKAGES[key];

29 if (!pkg) {

30 const supported = Object.keys(PLATFORM_PACKAGES).join(", ");

31 fail(

32 `unsupported platform: ${key}\n` +

33 `Supported: ${supported}\n` +

34 `Build from source instead: https://github.com/zeb-link/hitmaker`

35 );

36 }

38 const binary = process.platform === "win32" ? "hitmaker.exe" : "hitmaker";

40 try {

41 return require.resolve(`${pkg}/bin/${binary}`);

42 } catch {

43 fail(

44 `the ${pkg} package is missing.\n` +

45 `It ships the native binary and installs automatically as an optional dependency.\n` +

46 `If you installed with --no-optional or --omit=optional, reinstall without it:\n` +

47 ` npm i -g hitmaker`

48 );

49 }

50}

52const result = spawnSync(resolveBinary(), process.argv.slice(2), {

53 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/hitmaker.jsView on unpkg · L46

54});

56if (result.error) {

57 fail(result.error.message);

58}

60// Re-raise the child's terminating signal so callers see the real cause

61// (Ctrl-C should look like Ctrl-C to the parent shell, not a plain exit 0).

62if (result.signal) {

63 process.kill(process.pid, result.signal);

64}

66process.exit(result.status ?? 1);

Source & flagged code

2 flagged · loading source

bin/hitmaker.jsView file

8L9: const { spawnSync } = require("node:child_process"); L10:

High

Child Process

Package source references child process execution.

bin/hitmaker.jsView on unpkg · L8

46`If you installed with --no-optional or --omit=optional, reinstall without it:\n` + L47: ` npm i -g hitmaker` L48: ); ... L51: L52: const result = spawnSync(resolveBinary(), process.argv.slice(2), { L53: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/hitmaker.jsView on unpkg · L46

Findings

2 High1 Low

HighChild Processbin/hitmaker.js

HighRuntime Package Installbin/hitmaker.js

LowUrl Strings

Source & flagged code

2 flagged

bin/hitmaker.jsView file

Lines 1-66javascript

1#!/usr/bin/env node

2// Launcher for the hitmaker binary.

3//

4// The native binary ships in a per-platform package (@zeb-link/hitmaker-darwin-arm64

5// and friends) listed under optionalDependencies. npm installs only the one

6// matching the host, and this shim hands off to it with stdio inherited so the

7// Bubble Tea TUI keeps a real TTY.

9const { spawnSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/hitmaker.jsView on unpkg · L8

11const PLATFORM_PACKAGES = {

12 "darwin arm64": "@zeb-link/hitmaker-darwin-arm64",

13 "darwin x64": "@zeb-link/hitmaker-darwin-x64",

14 "linux arm64": "@zeb-link/hitmaker-linux-arm64",

15 "linux x64": "@zeb-link/hitmaker-linux-x64",

16 "win32 arm64": "@zeb-link/hitmaker-win32-arm64",

17 "win32 x64": "@zeb-link/hitmaker-win32-x64",

18};

20function fail(message) {

21 console.error(`hitmaker: ${message}`);

22 process.exit(1);

23}

25function resolveBinary() {

26 const key = `${process.platform} ${process.arch}`;

27 const pkg = PLATFORM_PACKAGES[key];

29 if (!pkg) {

30 const supported = Object.keys(PLATFORM_PACKAGES).join(", ");

31 fail(

32 `unsupported platform: ${key}\n` +

33 `Supported: ${supported}\n` +

34 `Build from source instead: https://github.com/zeb-link/hitmaker`

35 );

36 }

38 const binary = process.platform === "win32" ? "hitmaker.exe" : "hitmaker";

40 try {

41 return require.resolve(`${pkg}/bin/${binary}`);

42 } catch {

43 fail(

44 `the ${pkg} package is missing.\n` +

45 `It ships the native binary and installs automatically as an optional dependency.\n` +

46 `If you installed with --no-optional or --omit=optional, reinstall without it:\n` +

47 ` npm i -g hitmaker`

48 );

49 }

50}

52const result = spawnSync(resolveBinary(), process.argv.slice(2), {

53 stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/hitmaker.jsView on unpkg · L46

54});

56if (result.error) {

57 fail(result.error.message);

58}

60// Re-raise the child's terminating signal so callers see the real cause

61// (Ctrl-C should look like Ctrl-C to the parent shell, not a plain exit 0).

62if (result.signal) {

63 process.kill(process.pid, result.signal);

64}

66process.exit(result.status ?? 1);