registry / hscrape / 0.2.33

hscrape@0.2.33

Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The automatic installation and replacement of a Claude Code skill creates a concrete, limited agent-extension lifecycle risk. The inspected source does not establish a broader control-surface attack, so this warrants a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall, or a later hscrape invocation

Impact

Claude Code receives the bundled skill instructions, and existing customizations in that directory can be lost on update.

Mechanism

The installer removes the named skill directory and recursively copies the package's bundled skill into it when its version stamp differs.

AI rationale

Evidence

package.jsonlib/install-skill.jshscrape.jsskill/SKILL.md~/.claude/skills/evo-scraper

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs the skill installer automatically from its npm postinstall hook.
The installer targets a named skill directory in the user's Claude Code skills folder.
When the version stamp does not match, the installer recursively removes that directory and copies in the bundled skill.
The hscrape launcher also runs the installer when the CLI is invoked.
The bundled file identifies itself as an Evo scraper skill for Claude Code.
A matching version stamp makes the installer leave the existing skill directory and its local edits alone.

Evidence against

The inspected installer targets one named skill directory; it does not modify broad Claude Code settings.
The bundled skill describes Evo scraper workflows, and the inspected source does not establish credential transfer or remote code execution.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

Source & flagged code

7 flagged

package.jsonView file

Lines 1-34json

2 "name": "hscrape",

3 "version": "0.2.33",

4 "description": "Evo Headless Scraper CLI. Installs the `hscrape` binary for your platform plus the evo-scraper skill for Claude Code.",

5 "bin": {

6 "hscrape": "hscrape.js"

7 },

8 "files": [

9 "hscrape.js",

10 "lib/",

11 "skill/"

12 ],

13 "scripts": {

14 "postinstall": "node lib/install-skill.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 },

16 "optionalDependencies": {

17 "@evom/hscrape-win32-x64": "0.2.33",

Medium

Suspicious Lifecycle Evidence

The package runs the skill installer automatically from its npm postinstall hook.

package.jsonView on unpkg · L13

18 "@evom/hscrape-win32-arm64": "0.2.33",

19 "@evom/hscrape-darwin-x64": "0.2.33",

20 "@evom/hscrape-darwin-arm64": "0.2.33",

21 "@evom/hscrape-linux-x64": "0.2.33",

22 "@evom/hscrape-linux-arm64": "0.2.33"

23 },

24 "engines": {

25 "node": ">=16.7.0"

26 },

27 "keywords": [

28 "evo",

29 "scraper",

30 "cli",

31 "claude"

32 ],

33 "license": "UNLICENSED"

34}

hscrape.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2'use strict';

4// Launcher for the platform-specific `hscrape` binary.

5//

6// The real binary ships in an optionalDependency (hscrape-<os>-<cpu>) so that a

7// plain `npm install` only downloads the ONE binary matching the host. This shim

8// resolves that binary, makes sure the evo-scraper Claude skill is in place, then

9// execs the binary and forwards its exit code.

11const {

lib/install-skill.jsView file

Lines 1-43javascript

1'use strict';

3// Copies the bundled evo-scraper Claude Code skill into the user's personal

4// skills directory (~/.claude/skills/evo-scraper) so Claude Code discovers it.

5//

6// Idempotent: a version stamp means we only re-copy when the package version

7// changes. Runs from two places so it survives disabled install scripts:

8// 1. the package `postinstall` (node lib/install-skill.js)

9// 2. the first `hscrape` invocation (the shim calls ensure())

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/install-skill.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

13"scripts": { "postinstall": "node lib/install-skill.js" }, "optionalDependencies": { "

Medium

Suspicious Lifecycle Evidence

The package runs the skill installer automatically from its npm postinstall hook.

package.jsonView on unpkg · L13

hscrape.jsView file

•matchType = malicious_source_fingerprint_signature signature = 7a61e4da9783e0b0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hscrape@0.2.21 matchedPath = hscrape.js matchedIdentity = npm:aHNjcmFwZQ:0.2.21 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

Findings

1 Critical2 High6 Medium3 Low

CriticalAi Agent Control Hijacklib/install-skill.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Fingerprint Signaturehscrape.js

MediumDynamic Requirehscrape.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencelib/install-skill.js

LowScripts Present

LowFilesystem

LowNo License

Affected versions and remediation

This report applies to hscrape@0.2.33.

See all versions of hscrape for other recorded verdicts.

Review the evidence and your use of hscrape@0.2.33 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 17:24:39.715Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.