Loading npm security reports…

hscrape@0.2.21: AI-agent control-surface risk | LPM Firewall

registry / hscrape / 0.2.21

hscrape@0.2.21

Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically alters the user's Claude Code skill control surface. It removes and replaces a global skill directory without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook; invoking hscrape repeats the copy.

Impact

A package-controlled skill becomes available to Claude Code and overwrites any existing skill with the same name.

Mechanism

Automatic deletion and replacement of a personal Claude Code skill directory.

Policy narrative

On npm installation, package.json starts lib/install-skill.js. That code resolves the user's home directory, deletes ~/.claude/skills/evo-scraper recursively, and copies package-provided skill instructions there. The hscrape launcher performs the same mutation again on normal CLI use. This is an unconsented postinstall write to a foreign, user-wide AI-agent control surface.

AI rationale

The package has a concrete, automatic postinstall mutation of a global Claude Code skill directory and forcibly replaces its contents. This meets the install-control-surface blocking policy despite no observed network exfiltration.

Evidence

package.jsonlib/install-skill.jshscrape.jsskill/~/.claude/skills/evo-scraper~/.claude/skills/evo-scraper/.hscrape-version

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node lib/install-skill.js" }

High

Suspicious Lifecycle Evidence

An automatic postinstall hook runs the skill installer.

package.jsonView on unpkg · L13

hscrape.jsView file

•matchType = malicious_source_fingerprint_signature signature = 7a61e4da9783e0b0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hscrape@0.2.10 matchedPath = hscrape.js matchedIdentity = npm:aHNjcmFwZQ:0.2.10 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

hscrape.jsView on unpkg

10L11: const { spawnSync } = require('child_process'); L12: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hscrape.jsView on unpkg · L10

lib/install-skill.jsView file

3// Copies the bundled evo-scraper Claude Code skill into the user's personal L4: // skills directory (~/.claude/skills/evo-scraper) so Claude Code discovers it. L5: // ... L22: function destDir() { L23: return path.join(os.homedir(), '.claude', 'skills', SKILL_NAME); L24: } ... L51: fs.rmSync(dest, { recursive: true, force: true }); L52: fs.mkdirSync(dest, { recursive: true }); L53: fs.cpSync(src, dest, { recursive: true }); // requires Node >= 16.7 L54: fs.writeFileSync(stamp, version); L55: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install-skill.jsView on unpkg · L3

18function sourceDir() { return path.join(__dirname, '..', 'skill'); } function destDir() { return path.join(os.homedir(), '.claude', 'skills', SKILL_NAME); }

High

Ai Review Evidence

The installer targets the user's global Claude Code skills directory.

lib/install-skill.jsView on unpkg · L18

51fs.rmSync(dest, { recursive: true, force: true }); fs.mkdirSync(dest, { recursive: true }); fs.cpSync(src, dest, { recursive: true }); // requires Node >= 16.7 fs.writeFileSync(stamp, version);

High

Ai Review Evidence

It forcibly deletes and replaces the existing evo-scraper skill directory.

lib/install-skill.jsView on unpkg · L51

Source & flagged code

7 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "hscrape",

3 "version": "0.2.21",

4 "description": "Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.",

5 "bin": {

6 "hscrape": "hscrape.js"

7 },

8 "files": [

9 "hscrape.js",

10 "lib/",

11 "skill/"

12 ],

13 "scripts": {

14 "postinstall": "node lib/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 },

High

Suspicious Lifecycle Evidence

An automatic postinstall hook runs the skill installer.

package.jsonView on unpkg · L13

16 "optionalDependencies": {

17 "@evom/hscrape-win32-x64": "0.2.21",

18 "@evom/hscrape-win32-arm64": "0.2.21",

19 "@evom/hscrape-darwin-x64": "0.2.21",

20 "@evom/hscrape-darwin-arm64": "0.2.21",

21 "@evom/hscrape-linux-x64": "0.2.21",

22 "@evom/hscrape-linux-arm64": "0.2.21"

23 },

24 "engines": {

25 "node": ">=16.7.0"

26 },

27 "keywords": [

28 "evo",

29 "scraper",

30 "cli",

31 "claude"

32 ],

33 "license": "UNLICENSED"

34}

hscrape.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

3

4// Launcher for the platform-specific `hscrape` binary.

5//

6// The real binary ships in an optionalDependency (hscrape-<os>-<cpu>) so that a

7// plain `npm install` only downloads the ONE binary matching the host. This shim

8// resolves that binary, makes sure the evo-scraper Claude skill is in place, then

9// execs the binary and forwards its exit code.

10

11const {

lib/install-skill.jsView file

Lines 1-69javascript

1'use strict';

2

3// Copies the bundled evo-scraper Claude Code skill into the user's personal

4// skills directory (~/.claude/skills/evo-scraper) so Claude Code discovers it.

5//

6// Idempotent: a version stamp means we only re-copy when the package version

7// changes. Runs from two places so it survives disabled install scripts:

8// 1. the package `postinstall` (node lib/install-skill.js)

9// 2. the first `hscrape` invocation (the shim calls ensure())

10

11