hub-launch@1.21.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

hub-launch@1.21.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/shell.jsView file

1import { exec, spawn } from 'child_process'; L2: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/utils/shell.jsView on unpkg · L1

4import { logger } from './logger.js'; L5: const execAsync = promisify(exec); L6: /**

High

Shell

Package source references shell execution.

dist/utils/shell.jsView on unpkg · L4

dist/config/index.jsView file

67const moduleUrl = `${configUrl}?update=${Date.now()}`; L68: const configModule = (await import(moduleUrl)); L69: // Get the config - try default export first, then named 'config' export, then the module itself

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.jsView on unpkg · L67

dist/commands/init.jsView file

165L166: const context: HookContext = JSON.parse(contextJson); L167: console.log(\`🚀 Starting preview for: \${context.deploymentUrl}\`); ... L169: // Browser headless mode: Use env var or default to visible L170: const headless = process.env.CI === "true" || process.env.HEADLESS === "true"; L171: ... L192: const email = process.env.TEST_USER_EMAIL; L193: const password = process.env.TEST_USER_PASSWORD; L194: ... L411: # Test with sample context L412: tsx .[redacted].ts '{"deploymentUrl":"https://example.com","prNumber":123}' L413:

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/init.jsView on unpkg · L165

165Trigger-reachable chain: manifest.main -> dist/index.js -> dist/commands/init.js L165: L166: const context: HookContext = JSON.parse(contextJson); L167: console.log(\`🚀 Starting preview for: \${context.deploymentUrl}\`); ... L169: // Browser headless mode: Use env var or default to visible L170: const headless = process.env.CI === "true" || process.env.HEADLESS === "true"; L171: ... L192: const email = process.env.TEST_USER_EMAIL; L193: const password = process.env.TEST_USER_PASSWORD; L194: ... L411: # Test with sample context L412: tsx .[redacted].ts '{"deploymentUrl":"https://example.com","prNumber":123}' L413:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/init.jsView on unpkg · L165

165Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/commands/init.js L165: L166: const context: HookContext = JSON.parse(contextJson); L167: console.log(\`🚀 Starting preview for: \${context.deploymentUrl}\`); ... L169: // Browser headless mode: Use env var or default to visible L170: const headless = process.env.CI === "true" || process.env.HEADLESS === "true"; L171: ... L192: const email = process.env.TEST_USER_EMAIL; L193: const password = process.env.TEST_USER_PASSWORD; L194: ... L411: # Test with sample context L412: tsx .[redacted].ts '{"deploymentUrl":"https://example.com","prNumber":123}' L413:

scripts/postinstall.mjsView file

4* L5: * Writes ~/.claude/commands/<skill>.md for each hula Agent Skill, sourcing the L6: * command body from the package's bundled SKILL.md files. This makes /hula-plan, ... L25: existsSync, L26: mkdirSync, L27: readFileSync, L28: writeFileSync, L29: } from 'node:fs'; ... L70: L71: const commandsDir = join(homedir(), '.claude', 'commands'); L72: mkdirSync(commandsDir, { recursive: true }); L73:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

dist/services/hooks/HookExecutor.jsView file

130const contextJson = JSON.stringify(context); L131: // Execute with npx tsx using execFile L132: // shell: true is required for Windows to find npx.cmd L133: await execFileAsync('npx', ['tsx', fullPath, contextJson], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/hooks/HookExecutor.jsView on unpkg · L130

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hub-launch@1.13.0 matchedIdentity = npm:aHViLWxhdW5jaA:1.13.0 similarity = 0.863 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 3-43json

3 "version": "1.21.0",

4 "description": "GitHub Issue and PR automation CLI tool with plugin/hook system for project-specific customizations",

5 "type": "module",

6 "main": "./dist/index.js",

7 "bin": {

8 "hublaunch": "./dist/index.js",

9 "hula": "./dist/index.js",

10 "hl": "./dist/index.js"

11 },

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/NoStackApp/hub-launch.git"

15 },

16 "homepage": "https://github.com/NoStackApp/hub-launch#readme",

17 "bugs": {

18 "url": "https://github.com/NoStackApp/hub-launch/issues"

19 },

20 "scripts": {

21 "build": "tsc && shx chmod +x dist/index.js && npm run copy-templates",

22 "postbuild": "node scripts/postinstall.mjs",

23 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "copy-templates": "shx mkdir -p dist/templates && shx cp src/templates/*.md dist/templates/ && shx mkdir -p dist/templates/skills && shx cp -r src/templates/skills/* dist/templates/skills/",

25 "watch": "tsc --watch",

26 "dev": "tsx src/index.ts",

27 "debug": "tsx --inspect-brk src/index.ts",

28 "typecheck": "tsc --noEmit",

29 "test": "vitest run",

30 "test:watch": "vitest",

31 "regression": "tsc --noEmit && tsc && shx chmod +x dist/index.js && npm run copy-templates && vitest run",

32 "clean": "shx rm -rf dist",

33 "install:global": "npm run build && pnpm link --global && pnpm setup",

34 "i:hula": "pnpm install && npm run install:global",

35 "release": "bash scripts/release.sh"

36 },

37 "keywords": [

38 "github",

39 "cli",

40 "automation",

41 "pr",

42 "issue",

43 "copilot",

dist/utils/shell.jsView file

Lines 1-24javascript

1import { exec, spawn } from 'child_process';

2import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/utils/shell.jsView on unpkg · L1

3import { resolve } from 'path';

4import

dist/config/index.jsView file

Lines 47-87javascript

47 const originalEmitWarning = process.emitWarning;

48 process.emitWarning = (warning, ...args) => {

49 // Filter out the MODULE_TYPELESS_PACKAGE_JSON warning

50 if

dist/commands/init.jsView file

Lines 145-185javascript

145 * prNumber?: number;

146 * prTitle?: string;

147 * prUrl?: string;

148 * }

149 */

150

151

scripts/postinstall.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2/**

3 * postinstall: generate global Claude Code slash commands for hula.

4 *

5 * Writes ~/.claude/commands/<skill>.md for each hula Agent Skill, sourcing the

6 * command body from the package's bundled SKILL.md files. This makes /hula-plan,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

7 * /hula-fix, etc. available in EVERY project's Claude Code session with zero

8 * per-project footprint — the "install hula → skills appear" model, no

dist/services/hooks/HookExecutor.jsView file

130const contextJson = JSON.stringify(context); L131: // Execute with npx tsx using execFile L132: // shell: true is required for Windows to find npx.cmd L133: await execFileAsync('npx', ['tsx', fullPath, contextJson], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/hooks/HookExecutor.jsView on unpkg · L130

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hub-launch@1.13.0 matchedIdentity = npm:aHViLWxhdW5jaA:1.13.0 similarity = 0.863 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg