Loading npm security reports…

hub-launch@1.26.0: AI-agent control-surface risk | LPM Firewall

registry / hub-launch / 1.26.0

hub-launch@1.26.0

GitHub Issue and PR automation CLI tool with plugin/hook system for project-specific customizations

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the user's global Claude Code command directory. It writes eleven bundled command files, replacing files with the same names.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install, which runs postinstall automatically.

Impact

This unconsented lifecycle hook changes a broad AI-agent control surface for every project using that user profile.

Mechanism

Postinstall writes bundled skills into ~/.claude/commands.

Policy narrative

A normal npm installation invokes scripts/postinstall.mjs. That script creates ~/.claude/commands and copies the package's bundled skill text into eleven globally active Claude Code slash-command files. The writes occur without a user command or project-level consent and overwrite existing files with those names, extending the package's influence to unrelated projects and future agent sessions.

Rationale

The automatic postinstall mutation of a global Claude Code command surface is concrete, broad, and unconsented. This meets the install-control-surface block policy even though the installer itself makes no network request.

Evidence

package.jsonscripts/postinstall.mjs~/.claude/commands/hula-plan.md~/.claude/commands/hula-confirm.md~/.claude/commands/hula-fix.md~/.claude/commands/hula-create.md~/.claude/commands/hula-verify.md~/.claude/commands/hula-approve.md

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/shell.jsView file

1import { exec, spawn } from 'child_process'; L2: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/utils/shell.jsView on unpkg · L1

4import { logger } from './logger.js'; L5: const execAsync = promisify(exec); L6: /**

High

Shell

Package source references shell execution.

dist/utils/shell.jsView on unpkg · L4

dist/config/index.jsView file

67const moduleUrl = `${configUrl}?update=${Date.now()}`; L68: const configModule = (await import(moduleUrl)); L69: // Get the config - try default export first, then named 'config' export, then the module itself

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.jsView on unpkg · L67

dist/commands/init.jsView file

142L143: - On success it must print \`{"envVars": {"KEY": "value", ...}}\` to **stdout**. L144: Those values are merged into the launch request's \`envVars\`, taking ... L207: const contextJson = process.argv[2]; L208: const context: HookContext = JSON.parse(contextJson); L209: ... L249: TEST_USER_EMAIL=test@example.com L250: TEST_USER_PASSWORD=your-test-password L251: CUSTOM_API_KEY=your-api-key ... L255: \`\`\`typescript L256: const email = process.env.TEST_USER_EMAIL; L257: \`\`\`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/init.jsView on unpkg · L142

142Trigger-reachable chain: manifest.main -> dist/index.js -> dist/commands/init.js L142: L143: - On success it must print \`{"envVars": {"KEY": "value", ...}}\` to **stdout**. L144: Those values are merged into the launch request's \`envVars\`, taking ... L207: const contextJson = process.argv[2]; L208: const context: HookContext = JSON.parse(contextJson); L209: ... L249: TEST_USER_EMAIL=test@example.com L250: TEST_USER_PASSWORD=your-test-password L251: CUSTOM_API_KEY=your-api-key ... L255: \`\`\`typescript L256: const email = process.env.TEST_USER_EMAIL; L257: \`\`\`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/init.jsView on unpkg · L142

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. d obsolete settings no longer used by hula (daytona is now server-managed): ${droppedobsoletekeys.join(', ')}`); } const gitignorepath = join(reporoot, '.gitignore'); try { let gitignorecontent = ''; if (existssync(gitignorepath)) { gitignorecontent = await import('fs/promises').then((fs) => fs.readfile(gitignorepath, 'utf-8')); } const originalgitignorecontent = gitignorecontent; const beforeconfig = gitignorecontent; gitignorecontent = appendgitignoreentry(gitignorecontent, 'hublaunch.config.js', '

dist/commands/launch.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/commands/launch.js: import { existsSync, readFileSync, writeFileSync } from 'fs'; .option('--api-key <key>', 'Override API key') * OAuth tokens (Bearer) and API keys (x-api-key); openai/openrouter use Bearer. Authorization: `Bearer ${authToken}`, invalidHint: 'Generate a new credential — a subscription OAuth token at https://claude.ai/settings (Pro/Max) or an API key at https://platform.claude.com.', headers: { Authorization: `Bearer ${authToken}` }, invalidHint: 'Create a new API key at https://platform.openai.com/api-keys.', headers: { Authorization: `Bearer ${authToken}` },

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/commands/launch.jsView on unpkg

scripts/postinstall.mjsView file

4* L5: * Writes ~/.claude/commands/<skill>.md for each hula Agent Skill, sourcing the L6: * command body from the package's bundled SKILL.md files. This makes /hula-plan, ... L25: existsSync, L26: mkdirSync, L27: readFileSync, L28: writeFileSync, L29: } from 'node:fs'; ... L70: L71: const commandsDir = join(homedir(), '.claude', 'commands'); L72: mkdirSync(commandsDir, { recursive: true }); L73:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

dist/services/hooks/HookExecutor.jsView file

176const contextJson = JSON.stringify(context); L177: const child = spawn('npx', ['tsx', fullPath, contextJson], { L178: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/hooks/HookExecutor.jsView on unpkg · L176

dist/commands/clean.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/clean.js#virtual:normalized:round1View on unpkg

dist/commands/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.25.0 matchedPath = dist/commands/interactive.js matchedIdentity = npm:aHViLWxhdW5jaA:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/interactive.jsView on unpkg

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hub-launch@1.13.0 matchedIdentity = npm:aHViLWxhdW5jaA:1.13.0 similarity = 0.725 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = hub-launch@1.25.0 matchedPath = dist/commands/login.js matchedIdentity = npm:aHViLWxhdW5jaA:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/login.jsView on unpkg

dist/services/github/GithubAppService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.25.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/GithubAppService.jsView on unpkg

dist/utils/github-cli.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.25.0 matchedPath = dist/utils/github-cli.js matchedIdentity = npm:aHViLWxhdW5jaA:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/github-cli.jsView on unpkg

dist/utils/editor.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.25.0 matchedPath = dist/utils/editor.js matchedIdentity = npm:aHViLWxhdW5jaA:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/editor.jsView on unpkg

dist/services/github/AssetUploadService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.25.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.25.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/AssetUploadService.jsView on unpkg