hub-launch@1.22.0: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

hub-launch@1.22.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/shell.jsView file

1import { exec, spawn } from 'child_process'; L2: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/utils/shell.jsView on unpkg · L1

4import { logger } from './logger.js'; L5: const execAsync = promisify(exec); L6: /**

High

Shell

Package source references shell execution.

dist/utils/shell.jsView on unpkg · L4

dist/config/index.jsView file

67const moduleUrl = `${configUrl}?update=${Date.now()}`; L68: const configModule = (await import(moduleUrl)); L69: // Get the config - try default export first, then named 'config' export, then the module itself

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.jsView on unpkg · L67

dist/commands/init.jsView file

165L166: const context: HookContext = JSON.parse(contextJson); L167: console.log(\`🚀 Starting preview for: \${context.deploymentUrl}\`); ... L169: // Browser headless mode: Use env var or default to visible L170: const headless = process.env.CI === "true" || process.env.HEADLESS === "true"; L171: ... L192: const email = process.env.TEST_USER_EMAIL; L193: const password = process.env.TEST_USER_PASSWORD; L194: ... L411: # Test with sample context L412: tsx .[redacted].ts '{"deploymentUrl":"https://example.com","prNumber":123}' L413:

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/init.jsView on unpkg · L165

165Trigger-reachable chain: manifest.main -> dist/index.js -> dist/commands/init.js L165: L166: const context: HookContext = JSON.parse(contextJson); L167: console.log(\`🚀 Starting preview for: \${context.deploymentUrl}\`); ... L169: // Browser headless mode: Use env var or default to visible L170: const headless = process.env.CI === "true" || process.env.HEADLESS === "true"; L171: ... L192: const email = process.env.TEST_USER_EMAIL; L193: const password = process.env.TEST_USER_PASSWORD; L194: ... L411: # Test with sample context L412: tsx .[redacted].ts '{"deploymentUrl":"https://example.com","prNumber":123}' L413:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/init.jsView on unpkg · L165

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. d obsolete settings no longer used by hula (daytona is now server-managed): ${droppedobsoletekeys.join(', ')}`); } const gitignorepath = join(reporoot, '.gitignore'); try { let gitignorecontent = ''; if (existssync(gitignorepath)) { gitignorecontent = await import('fs/promises').then((fs) => fs.readfile(gitignorepath, 'utf-8')); } const originalgitignorecontent = gitignorecontent; const beforeconfig = gitignorecontent; gitignorecontent = appendgitignoreentry(gitignorecontent, 'hublaunch.config.js', '

scripts/postinstall.mjsView file

4* L5: * Writes ~/.claude/commands/<skill>.md for each hula Agent Skill, sourcing the L6: * command body from the package's bundled SKILL.md files. This makes /hula-plan, ... L25: existsSync, L26: mkdirSync, L27: readFileSync, L28: writeFileSync, L29: } from 'node:fs'; ... L70: L71: const commandsDir = join(homedir(), '.claude', 'commands'); L72: mkdirSync(commandsDir, { recursive: true }); L73:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

dist/services/hooks/HookExecutor.jsView file

130const contextJson = JSON.stringify(context); L131: // Execute with npx tsx using execFile L132: // shell: true is required for Windows to find npx.cmd L133: await execFileAsync('npx', ['tsx', fullPath, contextJson], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/hooks/HookExecutor.jsView on unpkg · L130

dist/commands/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.21.0 matchedPath = dist/commands/interactive.js matchedIdentity = npm:aHViLWxhdW5jaA:1.21.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/interactive.jsView on unpkg

dist/commands/login.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.21.0 matchedPath = dist/commands/login.js matchedIdentity = npm:aHViLWxhdW5jaA:1.21.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/login.jsView on unpkg

dist/services/github/GithubAppService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.21.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.21.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/GithubAppService.jsView on unpkg

dist/utils/editor.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.21.0 matchedPath = dist/utils/editor.js matchedIdentity = npm:aHViLWxhdW5jaA:1.21.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/editor.jsView on unpkg

dist/services/github/AssetUploadService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.21.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.21.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/AssetUploadService.jsView on unpkg