Loading npm security reports…

hub-launch@1.27.0: AI-agent control-surface risk | LPM Firewall

registry / hub-launch / 1.27.0

hub-launch@1.27.0

GitHub Issue and PR automation CLI tool with plugin/hook system for project-specific customizations

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package modifies the user's global Claude Code command surface. It installs AI command instructions that can invoke Bash and package workflows in every project.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm installation runs postinstall.

Impact

Persists package-authored AI instructions across unrelated projects and expands agent command execution capability without an explicit setup action.

Mechanism

Automatic global Claude Code command injection.

Policy narrative

On installation, npm runs scripts/postinstall.mjs. The script creates ~/.claude/commands and copies bundled SKILL.md files there, making package-authored commands available globally. One installed command permits Bash and directs an AI to run hula scripts. This is an unconsented postinstall mutation of a broad, foreign AI-agent control surface.

Rationale

The package automatically writes persistent global Claude Code commands during postinstall, meeting the install-hook abuse blocking boundary. No install-time network exfiltration was observed, but it is not required for this concrete control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjsdist/templates/skills/hula-launch/SKILL.mddist/templates/skills/*/SKILL.md~/.claude/commands/hula-*.md

Decision evidence

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/shell.jsView file

1import { exec, spawn } from 'child_process'; L2: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

dist/utils/shell.jsView on unpkg · L1

4import { logger } from './logger.js'; L5: const execAsync = promisify(exec); L6: /**

High

Shell

Package source references shell execution.

dist/utils/shell.jsView on unpkg · L4

dist/config/index.jsView file

67const moduleUrl = `${configUrl}?update=${Date.now()}`; L68: const configModule = (await import(moduleUrl)); L69: // Get the config - try default export first, then named 'config' export, then the module itself

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/index.jsView on unpkg · L67

dist/commands/init.jsView file

144L145: - On success it must print \`{"envVars": {"KEY": "value", ...}}\` to **stdout**. L146: Those values are merged into the launch request's \`envVars\`, taking ... L209: const contextJson = process.argv[2]; L210: const context: HookContext = JSON.parse(contextJson); L211: ... L251: TEST_USER_EMAIL=test@example.com L252: TEST_USER_PASSWORD=your-test-password L253: CUSTOM_API_KEY=your-api-key ... L257: \`\`\`typescript L258: const email = process.env.TEST_USER_EMAIL; L259: \`\`\`

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/commands/init.jsView on unpkg · L144

144Trigger-reachable chain: manifest.main -> dist/index.js -> dist/commands/init.js L144: L145: - On success it must print \`{"envVars": {"KEY": "value", ...}}\` to **stdout**. L146: Those values are merged into the launch request's \`envVars\`, taking ... L209: const contextJson = process.argv[2]; L210: const context: HookContext = JSON.parse(contextJson); L211: ... L251: TEST_USER_EMAIL=test@example.com L252: TEST_USER_PASSWORD=your-test-password L253: CUSTOM_API_KEY=your-api-key ... L257: \`\`\`typescript L258: const email = process.env.TEST_USER_EMAIL; L259: \`\`\`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/init.jsView on unpkg · L144

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/commands/init.js: import { writeFile, readFile, readdir, mkdir, copyFile, rm, symlink, } from 'fs/promises'; * means BOTH a hula API key is present in the resolved config AND a saved .option('--with-claude-commands', 'Also write repo-local .claude/commands/* symlinks (default: use the global hula Claude Code plugin instead)') // { headers: { Authorization: \`Bearer \${process.env.NEON_API_KEY}\` } }, // Authorization: \`Bearer \${process.env.VERCEL_TOKEN}\`, Authorization: \`Bearer \${process.env.CUSTOM_DEPLOY_TOKEN}\`, await writeFile(readmePath, HOOKS_README_TEMPLATE, 'utf-8'); await writeFile(beforeLaunchPath, BEFORE_LA

scripts/postinstall.mjsView file

4* L5: * Writes ~/.claude/commands/<skill>.md for each hula Agent Skill, sourcing the L6: * command body from the package's bundled SKILL.md files. This makes /hula-plan, ... L25: existsSync, L26: mkdirSync, L27: readFileSync, L28: writeFileSync, L29: } from 'node:fs'; ... L70: L71: const commandsDir = join(homedir(), '.claude', 'commands'); L72: mkdirSync(commandsDir, { recursive: true }); L73:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L4

dist/services/hooks/HookExecutor.jsView file

176const contextJson = JSON.stringify(context); L177: const child = spawn('npx', ['tsx', fullPath, contextJson], { L178: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/hooks/HookExecutor.jsView on unpkg · L176

dist/commands/clean.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/clean.js#virtual:normalized:round1View on unpkg

dist/commands/interactive.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.26.0 matchedPath = dist/commands/interactive.js matchedIdentity = npm:aHViLWxhdW5jaA:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/interactive.jsView on unpkg

dist/commands/login.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hub-launch@1.13.0 matchedIdentity = npm:aHViLWxhdW5jaA:1.13.0 similarity = 0.725 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/login.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = hub-launch@1.26.0 matchedPath = dist/commands/login.js matchedIdentity = npm:aHViLWxhdW5jaA:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/login.jsView on unpkg

dist/services/github/GithubAppService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.26.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/GithubAppService.jsView on unpkg

dist/utils/github-cli.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.26.0 matchedPath = dist/utils/github-cli.js matchedIdentity = npm:aHViLWxhdW5jaA:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/github-cli.jsView on unpkg

dist/utils/editor.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.26.0 matchedPath = dist/utils/editor.js matchedIdentity = npm:aHViLWxhdW5jaA:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/editor.jsView on unpkg

dist/services/github/AssetUploadService.jsView file

•matchType = normalized_sha256 matchedPackage = hub-launch@1.26.0 matchedPath = [redacted].js matchedIdentity = npm:aHViLWxhdW5jaA:1.26.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/github/AssetUploadService.jsView on unpkg