registry / Install hook abuse / hyn-view

hyn-view

Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.

This report shows the evidence for hyn-view@1.8.0. 1 of 11 known versions is blocked or flagged. The newest version, 2.1.0, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package automatically creates root-owned persistence during installation and enables a self-updating execution path. The local-install and cloud-link guards reduce scope but do not neutralize the global-root install behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run npm install -g hyn-view as root on a Linux system with systemd.

Impact

The package establishes privileged persistence and can replace itself after installation.

Mechanism

Postinstall creates and enables persistent system services with managed self-updating.

Attack narrative

Installing this package globally as root triggers postinstall without a separate setup command. It invokes setup, writes under /etc and /var/lib, creates systemd units, and enables recurring timers. The record timer invokes the update startup path, while the default configuration permits automatic installation of newer releases. This creates persistent privileged execution and a continuing package-controlled update channel.

AI rationale

Evidence

package.jsonscripts/postinstall.shlib/setup.shlib/core.shbin/hyn/etc/hyn-view/var/lib/hyn-view/etc/systemd/system/hyn-push.service/etc/systemd/system/hyn-push.timer/etc/systemd/system/hyn-update.service/usr/local/bin/hyn

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The npm lifecycle runs a postinstall script.
On a global root Linux install, postinstall invokes unattended setup.
Setup writes system configuration and service units, then enables timers automatically.
A recurring record timer starts the automatic update check; updates default to install.
The package persists privileged scheduled execution and can fetch newer releases.

Evidence against

The lifecycle exits for local installs, non-root installs, and non-systemd hosts.
Cloud telemetry and portal commands require explicit device linking and a stored token.
The flagged Python file is a local test mock, not an install-time payload.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

10 flagged

package.jsonView file

Lines 1-39json

2 "name": "hyn-view",

3 "version": "1.8.0",

4 "description": "Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.",

5 "bin": {

6 "hyn": "bin/hyn",

7 "hyn-view": "bin/hyn"

8 },

9 "files": [

10 "bin/",

11 "lib/",

12 "scripts/",

13 "themes/",

14 "test/",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh",

High

Suspicious Lifecycle Evidence

The npm lifecycle runs a postinstall script.

package.jsonView on unpkg · L18

21 "test:db": "bash supabase/run-tests.sh"

22 },

23 "keywords": [

24 "alerting",

25 "bandwidth",

26 "bash",

27 "btop",

28 "daily-report",

29 "devops",

30 "email-alerts",

31 "highway",

32 "htop",

33 "hwaynetwork",

34 "monitor",

35 "network",

36 "node-operator",

37 "notifications",

38 "ntfy",

39 "proc",

test/cloud-mock.pyView file

•path = test/cloud-mock.py kind = payload_in_excluded_dir sizeBytes = 9283 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/cloud-mock.pyView on unpkg

•path = test/cloud-mock.py kind = build_helper sizeBytes = 9283 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/cloud-mock.pyView on unpkg

bin/hynView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/hynView on unpkg

lib/core.shView file

•matchType = previous_version_dangerous_delta matchedPackage = hyn-view@1.7.0 matchedIdentity = npm:aHluLXZpZXc:1.7.0 similarity = 0.467 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.shView on unpkg

scripts/postinstall.shView file

Lines 19-81text

19# configure itself is a degraded monitor, not a broken package.

20# 2. It only acts on a global install as root on a systemd Linux box. A local

21# `npm i hyn-view` in someone's project touches nothing.

22# 3. It is idempotent, and it never overwrites an existing config file.

23# 4. HYN_NO_POSTINSTALL=1 opts out completely, for image builders and CI.

24#

25# It does not pair with the portal, because pairing needs a human with a browser,

26# and it does not ask questions, because there is no terminal to ask on.

28set -u

30# Never let a monitoring tool's own setup break `npm install`.

lib/setup.shView file

Lines 384-424text

384 ((changed)) && printf ' %-34s corrected outdated shipped defaults\n' "$f"

385 return 0

386}

387

388setup_run() {

389 local no_timer=0 wizard=1 integration_ok=1 a

390 for a in "$@"; do

391 case $a in

392 --no-timer) no_timer=1 ;;

393 --no-wizard) wizard=0 ;;

394 --wizard) wizard=1 ;;

395 *) die "setup: unknown option $a" ;;

396 esac

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

18"scripts": { "postinstall": "bash scripts/postinstall.sh", "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh",

High

Suspicious Lifecycle Evidence

The npm lifecycle runs a postinstall script.

package.jsonView on unpkg · L18

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

test/cloud-mock.pyView file

Findings

8 High3 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtest/cloud-mock.py

HighSemantic Analysis Limitedbin/hyn

HighPrevious Version Dangerous Deltalib/core.sh

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencescripts/postinstall.sh

HighAi Review Evidencelib/setup.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helpertest/cloud-mock.py

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to hyn-view@1.8.0.

The versions list below shows the verdict for each recorded version.

Avoid installing hyn-view@1.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-30 18:29:12.435Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

2.1.0latestClean—AllowPublishedOct 15, 2026, 4:31 PM 2.0.0Clean—AllowPublishedSep 21, 2026, 8:01 PM 1.10.0SuspiciousInstall Hook AbuseWarnPublishedSep 12, 2026, 6:27 PM 1.9.0SuspiciousPersistenceWarnPublishedSep 11, 2026, 7:24 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code