registry / Install hook abuse / hyn-view / 1.10.0

hyn-view@1.10.0

Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No concealed payload, self-dependency, credential harvesting, or unpaired install-time network activity was found. However, the lifecycle hook creates persistent root services and enables automatic remote package updates, which is a concrete capability that warrants warning.

Static reason

One or more suspicious static signals were detected.

Trigger

Run npm install -g hyn-view as root on a Linux system with systemd.

Impact

It establishes root-level persistence and expands trust to future registry releases; paired installations can send monitoring telemetry to the HYN endpoint.

Mechanism

Postinstall-created persistent monitor with automatic self-update.

AI rationale

Evidence

package.jsonscripts/postinstall.shlib/setup.shlib/core.sh/etc/hyn-view/config/etc/hyn-view/secrets/var/lib/hyn-view/etc/systemd/system/hyn-*.service/etc/systemd/system/hyn-*.timer/usr/local/bin/hyn

Network endpoints3

registry.npmjs.orgwww.hyn-view.in/api/agent/v1hyn-view.in/api/agent/v1

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The postinstall hook invokes unattended setup on global root Linux installs.
Setup creates and enables persistent systemd services and timers.
The resident service has full filesystem write access and self-update capability.
The default configuration enables automatic updates from the npm registry.

Evidence against

The hook exits for local installs, non-Linux hosts, non-root users, and systems without systemd.
No runtime dependency or self-dependency is declared.
Cloud upload requires a separately paired node token; no endpoint is contacted by postinstall itself.
Flagged test scripts are readable shell regression tests using temporary directories, not hidden payloads.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

10 flagged

package.jsonView file

Lines 1-42json

2 "name": "hyn-view",

3 "version": "1.10.0",

4 "description": "Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.",

5 "bin": {

6 "hyn": "bin/hyn",

7 "hyn-view": "bin/hyn"

8 },

9 "files": [

10 "bin/",

11 "lib/",

12 "scripts/",

13 "themes/",

14 "test/",

15 "docs/local-storage-and-hosting.md",

16 "docs/cli-release-readiness.md",

17 "docs/rolling-monitoring.md",

18 "README.md",

19 "LICENSE"

20 ],

21 "scripts": {

22 "postinstall": "bash scripts/postinstall.sh",

Medium

Suspicious Lifecycle Evidence

The postinstall hook invokes unattended setup on global root Linux installs.

package.jsonView on unpkg · L21

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh && bash test/local-storage.sh && bash test/unattended.sh && bash test/bandwidth.sh && bash test/release-reliability.sh && bash test/report-reliability.sh && bash test/cloud-platform.sh",

24 "test:db": "bash supabase/run-tests.sh"

25 },

26 "keywords": [

27 "alerting",

28 "bandwidth",

29 "bash",

30 "btop",

31 "daily-report",

32 "devops",

33 "email-alerts",

34 "highway",

35 "htop",

36 "hwaynetwork",

37 "monitor",

38 "network",

39 "node-operator",

40 "notifications",

41 "ntfy",

42 "proc",

test/bandwidth.shView file

•path = test/bandwidth.sh kind = payload_in_excluded_dir sizeBytes = 3906 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/bandwidth.shView on unpkg

•path = test/bandwidth.sh kind = build_helper sizeBytes = 3906 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/bandwidth.shView on unpkg

bin/hynView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/hynView on unpkg

scripts/postinstall.shView file

Lines 17-81text

17#

18# 1. It NEVER fails the install. Every path exits 0. A monitor that cannot

19# configure itself is a degraded monitor, not a broken package.

20# 2. It only acts on a global install as root on a systemd Linux box. A local

21# `npm i hyn-view` in someone's project touches nothing.

22# 3. It is idempotent, and it never overwrites an existing config file.

23# 4. HYN_NO_POSTINSTALL=1 opts out completely, for image builders and CI.

24#

25# It does not pair with the portal, because pairing needs a human with a browser,

26# and it does not ask questions, because there is no terminal to ask on.

lib/setup.shView file

Lines 1-33text

1#!/usr/bin/env bash

2# hyn-view :: system integration

4# Global root npm installs call setup automatically. Re-running it repairs

5# configuration and boot services without prompting or replacing user data.

7# This never touches anything belonging to Highway.

9SVC_NAME='hyn-speedtest'

10SVC_PATH="$HYN_UNIT_DIR/$SVC_NAME.service"

11TMR_PATH="$HYN_UNIT_DIR/$SVC_NAME.timer"

13# What the managed units are allowed to do, and what they are held back from.

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

21"scripts": { "postinstall": "bash scripts/postinstall.sh",

Medium

Suspicious Lifecycle Evidence

The postinstall hook invokes unattended setup on global root Linux installs.

package.jsonView on unpkg · L21

test/bandwidth.shView file

Findings

3 High8 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtest/bandwidth.sh

HighSemantic Analysis Limitedbin/hyn

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helpertest/bandwidth.sh

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumSuspicious Lifecycle Evidencescripts/postinstall.sh

MediumAi Review Evidencelib/setup.sh

LowScripts Present

Affected versions and remediation

This report applies to hyn-view@1.10.0.

See all versions of hyn-view for other recorded verdicts.

Review the evidence and your use of hyn-view@1.10.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 18:29:19.299Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code