registry / AI-agent control-surface risk / hscrape
hscrape
Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.
This report shows the evidence for hscrape@0.2.21. 2 of 9 known versions are blocked or flagged. The newest version, 0.2.33, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has a concrete, automatic postinstall mutation of a global Claude Code skill directory and forcibly replaces its contents. This meets the install-control-surface blocking policy despite no observed network exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation runs the postinstall lifecycle hook; invoking hscrape repeats the copy.
Impact
A package-controlled skill becomes available to Claude Code and overwrites any existing skill with the same name.
Mechanism
Automatic deletion and replacement of a personal Claude Code skill directory.
Policy narrative
On npm installation, package.json starts lib/install-skill.js. That code resolves the user's home directory, deletes ~/.claude/skills/evo-scraper recursively, and copies package-provided skill instructions there. The hscrape launcher performs the same mutation again on normal CLI use. This is an unconsented postinstall write to a foreign, user-wide AI-agent control surface.
AI rationale
The package has a concrete, automatic postinstall mutation of a global Claude Code skill directory and forcibly replaces its contents. This meets the install-control-surface blocking policy despite no observed network exfiltration.
Evidence
package.jsonlib/install-skill.jshscrape.jsskill/~/.claude/skills/evo-scraper~/.claude/skills/evo-scraper/.hscrape-version
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- An automatic postinstall hook runs the skill installer.
- The installer targets the user's global Claude Code skills directory.
- It forcibly deletes and replaces the existing evo-scraper skill directory.
- The CLI repeats the skill installation whenever it is invoked.
Evidence against
- No network request, credential harvesting, or exfiltration is present in the inspected JavaScript.
- The copied skill content is bundled locally rather than downloaded at install time.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node lib/install-skill.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg13"scripts": {
"postinstall": "node lib/install-skill.js"
}
High
Suspicious Lifecycle Evidence
An automatic postinstall hook runs the skill installer.
package.jsonView on unpkg · L13hscrape.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 7a61e4da9783e0b0
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = hscrape@0.2.10
matchedPath = hscrape.js
matchedIdentity = npm:aHNjcmFwZQ:0.2.10
similarity = 1.000
shingleOverlap = 2
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
hscrape.jsView on unpkg10L11: const { spawnSync } = require('child_process');
L12: const fs = require('fs');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
hscrape.jsView on unpkg · L10lib/install-skill.jsView file
3// Copies the bundled evo-scraper Claude Code skill into the user's personal
L4: // skills directory (~/.claude/skills/evo-scraper) so Claude Code discovers it.
L5: //
...
L22: function destDir() {
L23: return path.join(os.homedir(), '.claude', 'skills', SKILL_NAME);
L24: }
...
L51: fs.rmSync(dest, { recursive: true, force: true });
L52: fs.mkdirSync(dest, { recursive: true });
L53: fs.cpSync(src, dest, { recursive: true }); // requires Node >= 16.7
L54: fs.writeFileSync(stamp, version);
L55: }
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
lib/install-skill.jsView on unpkg · L318function sourceDir() {
return path.join(__dirname, '..', 'skill');
}
function destDir() {
return path.join(os.homedir(), '.claude', 'skills', SKILL_NAME);
}
High
Ai Review Evidence
The installer targets the user's global Claude Code skills directory.
lib/install-skill.jsView on unpkg · L1851fs.rmSync(dest, { recursive: true, force: true });
fs.mkdirSync(dest, { recursive: true });
fs.cpSync(src, dest, { recursive: true }); // requires Node >= 16.7
fs.writeFileSync(stamp, version);
High
Ai Review Evidence
It forcibly deletes and replaces the existing evo-scraper skill directory.
lib/install-skill.jsView on unpkg · L51Findings
1 Critical5 High3 Medium3 Low
CriticalAi Agent Control Hijacklib/install-skill.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturehscrape.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencelib/install-skill.js
HighAi Review Evidencelib/install-skill.js
MediumDynamic Requirehscrape.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to hscrape@0.2.21.
The versions list below shows the verdict for each recorded version.
- Avoid installing hscrape@0.2.21. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
9 known versions0.2.33latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 15, 2026, 5:05 PM0.2.21shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 5, 2026, 5:39 PM0.2.20SuspiciousAgent extension lifecycle riskWarnPublishedAug 21, 2026, 1:27 AM0.2.19SuspiciousAgent extension lifecycle riskWarnPublishedAug 19, 2026, 9:46 PM0.2.16SuspiciousAgent extension lifecycle riskWarnPublishedAug 16, 2026, 3:08 PM0.2.15SuspiciousAgent extension lifecycle riskWarnPublishedAug 14, 2026, 7:28 PM0.2.10MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 17, 2026, 8:04 PM0.2.9SuspiciousAgent extension lifecycle riskWarnPublishedJul 13, 2026, 4:12 PM0.2.8SuspiciousAgent extension lifecycle riskWarnPublishedJul 13, 2026, 4:02 PM