Loading npm security reports…

hub-launch: AI-agent control-surface risk | LPM Firewall

registry / hub-launch / 1.30.0

hub-launch@1.30.0

GitHub Issue and PR automation CLI tool with plugin/hook system for project-specific customizations

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically installs its agent instructions into the global Claude Code command surface. Those commands apply to every project and are refreshed without an install-time consent prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation, unless HULA_SKIP_CLAUDE_COMMANDS is already set to 1.

Impact

A dependency install changes global AI-agent behavior across unrelated projects; an injected skill can direct agents to commit and push repository changes.

Mechanism

Postinstall writes bundled skills into ~/.claude/commands.

Policy narrative

The npm postinstall hook runs automatically and creates ~/.claude/commands, then copies twelve package-controlled skill files there. This mutates a broad, foreign AI-agent control surface rather than limiting setup to an explicit command or the current project. One installed command instructs an agent to auto-commit and push changes. The opt-out environment variable does not obtain consent before the mutation.

AI rationale

hub-launch@1.30.0 has a concrete automatic postinstall chain that installs package-controlled instructions into global Claude Code commands. This is unconsented mutation of a broad AI-agent control surface and meets the publish-block policy.

Evidence

package.jsonscripts/postinstall.mjsdist/templates/skills/hula-fix/SKILL.md~/.claude/commands/hula-plan.md~/.claude/commands/hula-fix.md

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/shell.jsView file

1import { exec, spawn } from 'child_process'; L2: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/utils/shell.jsView on unpkg · L1

4import { logger } from './logger.js'; L5: const execAsync = promisify(exec); L6: /**

High

Shell

Package source references shell execution.

dist/utils/shell.jsView on unpkg · L4

dist/config/index.jsView file

67const moduleUrl = `${configUrl}?update=${Date.now()}`; L68: const configModule = (await import(moduleUrl)); L69: // Get the config - try default export first, then named 'config' export, then the module itself

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.jsView on unpkg · L67

dist/commands/init.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/commands/init.js: import { writeFile, readFile, readdir, mkdir, copyFile, rm, symlink, } from 'fs/promises'; * means BOTH a hula API key is present in the resolved config AND a saved .option('--with-claude-commands', 'Also write repo-local .claude/commands/* symlinks (default: use the global hula Claude Code plugin instead)') // { headers: { Authorization: \`Bearer \${process.env.NEON_API_KEY}\` } }, // Authorization: \`Bearer \${process.env.VERCEL_TOKEN}\`, Authorization: \`Bearer \${process.env.CUSTOM_DEPLOY_TOKEN}\`, await writeFile(readmePath, HOOKS_README_TEMPLATE, 'utf-8'); await writeFile(beforeLaunchPath, BEFORE_LA

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/commands/init.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. d obsolete settings no longer used by hula (daytona is now server-managed): ${droppedobsoletekeys.join(', ')}`); } const gitignorepath = join(reporoot, '.gitignore'); try { let gitignorecontent = ''; if (existssync(gitignorepath)) { gitignorecontent = await import('fs/promises').then((fs) => fs.readfile(gitignorepath, 'utf-8')); } const originalgitignorecontent = gitignorecontent; const beforeconfig = gitignorecontent; gitignorecontent = appendgitignoreentry(gitignorecontent, 'hublaunch.config.js', '

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.mjsView file

4* L5: * Writes ~/.claude/commands/<skill>.md for each hula Agent Skill, sourcing the L6: * command body from the package's bundled SKILL.md files. This makes /hula-plan, ... L25: existsSync, L26: mkdirSync, L27: readFileSync, L28: writeFileSync, L29: } from 'node:fs'; ... L71: L72: const commandsDir = join(homedir(), '.claude', 'commands'); L73: mkdirSync(commandsDir, { recursive: true }); L74:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

dist/services/hooks/HookExecutor.jsView file

176const contextJson = JSON.stringify(context); L177: const child = spawn('npx', ['tsx', fullPath, contextJson], { L178: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/hooks/HookExecutor.jsView on unpkg · L176

dist/commands/clean.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/clean.js#virtual:normalized:round1View on unpkg

dist/commands/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.28.0 matchedPath = dist/commands/interactive.js matchedIdentity = npm:aHViLWxhdW5jaA:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/interactive.jsView on unpkg

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hub-launch@1.13.0 matchedIdentity = npm:aHViLWxhdW5jaA:1.13.0 similarity = 0.688 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = hub-launch@1.28.0 matchedPath = dist/commands/login.js matchedIdentity = npm:aHViLWxhdW5jaA:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/login.jsView on unpkg

dist/services/github/GithubAppService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.28.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/GithubAppService.jsView on unpkg

dist/utils/github-cli.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.28.0 matchedPath = dist/utils/github-cli.js matchedIdentity = npm:aHViLWxhdW5jaA:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/github-cli.jsView on unpkg

dist/utils/editor.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.28.0 matchedPath = dist/utils/editor.js matchedIdentity = npm:aHViLWxhdW5jaA:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/editor.jsView on unpkg

dist/services/github/AssetUploadService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.28.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/AssetUploadService.jsView on unpkg