Loading npm security reports…

hyn-view@1.8.0: Malicious npm security report (Block) | LPM Firewall

registry / hyn-view / 1.8.0

hyn-view@1.8.0

Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A root global installation automatically creates configuration, state, and systemd-managed recurring jobs. Those jobs include an automatic update path that checks for and can install newer package releases.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run npm install -g hyn-view as root on a Linux system with systemd.

Impact

The package establishes privileged persistence and can replace itself after installation.

Mechanism

Postinstall creates and enables persistent system services with managed self-updating.

Attack narrative

Installing this package globally as root triggers postinstall without a separate setup command. It invokes setup, writes under /etc and /var/lib, creates systemd units, and enables recurring timers. The record timer invokes the update startup path, while the default configuration permits automatic installation of newer releases. This creates persistent privileged execution and a continuing package-controlled update channel.

Rationale

The package automatically creates root-owned persistence during installation and enables a self-updating execution path. The local-install and cloud-link guards reduce scope but do not neutralize the global-root install behavior.

Evidence

package.jsonscripts/postinstall.shlib/setup.shlib/core.shbin/hyn/etc/hyn-view/var/lib/hyn-view/etc/systemd/system/hyn-push.service/etc/systemd/system/hyn-push.timer/etc/systemd/system/hyn-update.service

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

18"scripts": { "postinstall": "bash scripts/postinstall.sh", "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh",

High

Suspicious Lifecycle Evidence

The npm lifecycle runs a postinstall script.

package.jsonView on unpkg · L18

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

test/cloud-mock.pyView file

•path = test/cloud-mock.py kind = payload_in_excluded_dir sizeBytes = 9283 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/cloud-mock.pyView on unpkg

•path = test/cloud-mock.py kind = build_helper sizeBytes = 9283 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/cloud-mock.pyView on unpkg

bin/hynView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/hynView on unpkg

lib/core.shView file

•matchType = previous_version_dangerous_delta matchedPackage = hyn-view@1.7.0 matchedIdentity = npm:aHluLXZpZXc:1.7.0 similarity = 0.467 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.shView on unpkg

scripts/postinstall.shView file

39case ${npm[redacted]:-} in true | 1) ;; *) say 'local install detected; not configuring system services' say 'run `sudo hyn setup` if this was meant to be a global install' exit 0 ;;

High

Suspicious Lifecycle Evidence

On a global root Linux install, postinstall invokes unattended setup.

scripts/postinstall.shView on unpkg · L39

66say 'configuring system integration' # --no-wizard because there is no terminal to run a wizard on. Every default is # already the right answer for a 24/7 node, which is what makes this safe to do # unattended at all. if "$exe" setup --no-wizard; then

High

Suspicious Lifecycle Evidence

On a global root Linux install, postinstall invokes unattended setup.

scripts/postinstall.shView on unpkg · L66

lib/setup.shView file

404install -d -m 0755 "$HYN_ETC" "$HYN_ETC/themes" || die "cannot create $HYN_ETC" printf ' %-34s ok\n' "$HYN_ETC/" install -d -m 0755 "$HYN_VAR" || die "cannot create $HYN_VAR" printf ' %-34s ok\n' "$HYN_VAR/" if [[ -f $HYN_ETC/config ]]; then printf ' %-34s kept (already present)\n' "$HYN_ETC/config" setup_migrate_config else setup_config_template >"$HYN_ETC/config.tmp" && mv -f "$HYN_ETC/config.tmp" "$HYN_ETC/config" \ || die "cannot write $HYN_ETC/config" chmod 0644 "$HYN_ETC/config"

High

Ai Review Evidence

Setup writes system configuration and service units, then enables timers automatically.

lib/setup.shView on unpkg · L404

Source & flagged code

10 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "hyn-view",

3 "version": "1.8.0",

4 "description": "Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.",

5 "bin": {

6 "hyn": "bin/hyn",

7 "hyn-view": "bin/hyn"

8 },

9 "files": [

10 "bin/",

11 "lib/",

12 "scripts/",

13 "themes/",

14 "test/",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh",

High

Suspicious Lifecycle Evidence

The npm lifecycle runs a postinstall script.

package.jsonView on unpkg · L18

21 "test:db": "bash supabase/run-tests.sh"

22 },

23 "keywords": [

24 "alerting",

25 "bandwidth",

26 "bash",

27 "btop",

28 "daily-report",

29 "devops",

30 "email-alerts",

31 "highway",

32 "htop",

33 "hwaynetwork",

34 "monitor",

35 "network",

36 "node-operator",

37 "notifications",

38 "ntfy",

39 "proc",

test/cloud-mock.pyView file

•path = test/cloud-mock.py kind = payload_in_excluded_dir sizeBytes = 9283 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/cloud-mock.pyView on unpkg

•path = test/cloud-mock.py kind = build_helper sizeBytes = 9283 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/cloud-mock.pyView on unpkg

bin/hynView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/hynView on unpkg

lib/core.shView file

•matchType = previous_version_dangerous_delta matchedPackage = hyn-view@1.7.0 matchedIdentity = npm:aHluLXZpZXc:1.7.0 similarity = 0.467 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/core.shView on unpkg

scripts/postinstall.shView file

Lines 19-81text

19# configure itself is a degraded monitor, not a broken package.

20# 2. It only acts on a global install as root on a systemd Linux box. A local

21# `npm i hyn-view` in someone's project touches nothing.

22# 3. It is idempotent, and it never overwrites an existing config file.

23# 4. HYN_NO_POSTINSTALL=1 opts out completely, for image builders and CI.

24#

25# It does not pair with the portal, because pairing needs a human with a browser,

26# and it does not ask questions, because there is no terminal to ask on.

27

28set -u

29

30# Never let a monitoring tool's own setup break `npm install`.

lib/setup.shView file

Lines 384-424text

384 ((changed)) && printf ' %-34s corrected outdated shipped defaults\n' "$f"

385 return 0

386}

387

388setup_run() {

389 local no_timer=0 wizard=1 integration_ok=1 a

390 for a in "$@"; do

391 case $a in

392 --no-timer) no_timer=1 ;;

393 --no-wizard) wizard=0 ;;

394 --wizard) wizard=1 ;;

395 *) die "setup: unknown option $a" ;;

396 esac