registry / Persistence / hyn-view / 1.12.0

hyn-view@1.12.0

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not shown to perform a concrete malicious action, but its install hook establishes persistent unrestricted root services and automatic self-updates. That warrants a warning rather than publication blocking under the stated policy.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Run npm install -g hyn-view as root on a Linux system with systemd.

Impact

The package gains recurring root execution and can replace its own installed release.

Mechanism

Postinstall creates and enables persistent services that can update the package.

AI rationale

Evidence

package.jsonscripts/postinstall.shlib/setup.shlib/core.shlib/update.sh/etc/hyn-view/var/lib/hyn-view/etc/systemd/system/usr/local/bin/hyn

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script automatically.
On root global installs, postinstall invokes unattended setup.
Setup deliberately grants its systemd services full filesystem write access.
Setup enables a persistent root agent and update timer.
Automatic updates are enabled by default and install newer releases from npm.

Evidence against

Local installs exit without configuring services.
The lifecycle script requires a global Linux install running as root.
Portal pairing and telemetry require a separate user command and token.
The updater uses npm with lifecycle scripts disabled during its self-update step.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

20"scripts": { "postinstall": "bash scripts/postinstall.sh", "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh && bash test/local-storage.sh && bash test/unattended.sh && bash test/bandwidth.sh && bash test/release-reliability.sh && bash test/report-reliability.sh",

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L20

test/bandwidth.shView file

•path = test/bandwidth.sh kind = payload_in_excluded_dir sizeBytes = 3906 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/bandwidth.shView on unpkg

•path = test/bandwidth.sh kind = build_helper sizeBytes = 3906 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/bandwidth.shView on unpkg

bin/hynView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/hynView on unpkg

lib/highway.shView file

•matchType = normalized_sha256 matchedPackage = hyn-view@1.8.0 matchedPath = lib/highway.sh matchedIdentity = npm:aHluLXZpZXc:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/highway.shView on unpkg

lib/ui.shView file

•matchType = normalized_sha256 matchedPackage = hyn-view@1.8.0 matchedPath = lib/ui.sh matchedIdentity = npm:aHluLXZpZXc:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/ui.shView on unpkg

scripts/postinstall.shView file

39case ${npm[redacted]:-} in true | 1) ;; *) say 'local install detected; not configuring system services' say 'run `sudo hyn setup` if this was meant to be a global install' exit 0 ;; esac [[ $(uname -s 2>/dev/null) == Linux ]] || { say 'not Linux; nothing to configure'; exit 0; } if [[ ${EUID:-$(id -u)} -ne 0 ]]; then say 'not running as root, so the timers were not installed' say 'finish with: sudo hyn setup --no-wizard' exit 0 fi command -v systemctl >/dev/null 2>&1 || { say 'no systemd here; the CLI works but nothing will be scheduled' exit 0 } # Resolve

Medium

Suspicious Lifecycle Evidence

On root global installs, postinstall invokes unattended setup.

scripts/postinstall.shView on unpkg · L39

lib/setup.shView file

15# hyn has FULL WRITE ACCESS to the filesystem. That is deliberate and it is a # reversal: these units used to run under ProtectSystem=strict with # ReadWritePaths limited to one state directory, which read well in a README and # in practice meant the agent could not install its own updates, could not # rewrite its own units, and could not repair itself -- every one of those needs # /usr and /etc. A monitor that cannot fix itself on an unattended box is worse # than one with a wide mount namespace.

Medium

Ai Review Evidence

Setup deliberately grants its systemd services full filesystem write access.

lib/setup.shView on unpkg · L15

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L20

test/bandwidth.shView file

Findings

5 High6 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtest/bandwidth.sh

HighSemantic Analysis Limitedbin/hyn

HighKnown Malware Source Similaritylib/highway.sh

HighKnown Malware Source Similaritylib/ui.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helpertest/bandwidth.sh

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumSuspicious Lifecycle Evidencescripts/postinstall.sh

MediumAi Review Evidencelib/setup.sh

LowScripts Present

Affected versions and remediation

This report applies to hyn-view@1.12.0.

See all versions of hyn-view for other recorded verdicts.

Review the evidence and your use of hyn-view@1.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 19:21:03.503Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.