hscrape@0.2.16: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

hscrape@0.2.16: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node lib/install-skill.js" }

Medium

Suspicious Lifecycle Evidence

`postinstall` runs the skill installer.

package.jsonView on unpkg · L13

hscrape.jsView file

•matchType = malicious_source_fingerprint_signature signature = 7a61e4da9783e0b0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hscrape@0.2.10 matchedPath = hscrape.js matchedIdentity = npm:aHNjcmFwZQ:0.2.10 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

hscrape.jsView on unpkg

10L11: const { spawnSync } = require('child_process'); L12: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hscrape.jsView on unpkg · L10

lib/install-skill.jsView file

3// Copies the bundled evo-scraper Claude Code skill into the user's personal L4: // skills directory (~/.claude/skills/evo-scraper) so Claude Code discovers it. L5: // ... L22: function destDir() { L23: return path.join(os.homedir(), '.claude', 'skills', SKILL_NAME); L24: } ... L51: fs.rmSync(dest, { recursive: true, force: true }); L52: fs.mkdirSync(dest, { recursive: true }); L53: fs.cpSync(src, dest, { recursive: true }); // requires Node >= 16.7 L54: fs.writeFileSync(stamp, version); L55: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install-skill.jsView on unpkg · L3

42// Already at this version? leave it (and any local edits) alone. try { if (fs.existsSync(stamp) && fs.readFileSync(stamp, 'utf8').trim() === version) { return; } } catch { /* fall through and re-copy */ } fs.rmSync(dest, { recursive: true, force: true }); fs.mkdirSync(dest, { recursive: true }); fs.cpSync(src, dest, { recursive: true }); // requires Node >= 16.7 fs.writeFileSync(stamp, version);

Medium

Ai Review Evidence

Installer recursively deletes and replaces `~/.claude/skills/evo-scraper` on version change.

lib/install-skill.jsView on unpkg · L42

Source & flagged code

6 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "hscrape",

3 "version": "0.2.16",

4 "description": "Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.",

5 "bin": {

6 "hscrape": "hscrape.js"

7 },

8 "files": [

9 "hscrape.js",

10 "lib/",

11 "skill/"

12 ],

13 "scripts": {

14 "postinstall": "node lib/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 },

Medium

Suspicious Lifecycle Evidence

`postinstall` runs the skill installer.

package.jsonView on unpkg · L13

16 "optionalDependencies": {

17 "@evom/hscrape-win32-x64": "0.2.16",

18 "@evom/hscrape-win32-arm64": "0.2.16",

19 "@evom/hscrape-darwin-x64": "0.2.16",

20 "@evom/hscrape-darwin-arm64": "0.2.16",

21 "@evom/hscrape-linux-x64": "0.2.16",

22 "@evom/hscrape-linux-arm64": "0.2.16"

23 },

24 "engines": {

25 "node": ">=16.7.0"

26 },

27 "keywords": [

28 "evo",

29 "scraper",

30 "cli",

31 "claude"

32 ],

33 "license": "UNLICENSED"

34}

hscrape.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

3

4// Launcher for the platform-specific `hscrape` binary.

5//

6// The real binary ships in an optionalDependency (hscrape-<os>-<cpu>) so that a

7// plain `npm install` only downloads the ONE binary matching the host. This shim

8// resolves that binary, makes sure the evo-scraper Claude skill is in place, then

9// execs the binary and forwards its exit code.

10

11const {

lib/install-skill.jsView file

Lines 1-62javascript

1'use strict';

2

3// Copies the bundled evo-scraper Claude Code skill into the user's personal

4// skills directory (~/.claude/skills/evo-scraper) so Claude Code discovers it.

5//

6// Idempotent: a version stamp means we only re-copy when the package version

7// changes. Runs from two places so it survives disabled install scripts:

8// 1. the package `postinstall` (node lib/install-skill.js)

9// 2. the first `hscrape` invocation (the shim calls ensure())

10

11