registry / Persistence / hyn-view / 1.9.0

hyn-view@1.9.0

Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is not proven malware, but automatic root-level persistence and self-updating remote maintenance create a real high-impact capability beyond a normal npm CLI. The safeguards reduce the likelihood of direct abuse but do not remove the installation-time persistence risk.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Install globally as root on Linux with systemd; portal actions require a linked node token.

Impact

The package can keep privileged monitoring services running and can update its own installed package from the configured registry.

Mechanism

Automatic privileged systemd persistence with constrained remote maintenance commands.

AI rationale

Evidence

package.jsonscripts/postinstall.shlib/setup.shlib/cloud.shlib/update.shbin/hyn/etc/hyn-view/var/lib/hyn-view/etc/systemd/system

Network endpoints2

www.hyn-view.in/api/agent/v1registry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The install hook runs automatically after npm installation.
On root global Linux installs, the hook starts unattended system setup.
Setup writes systemd units and enables a resident service plus an update timer.
A linked portal can request only update or telemetry-sync actions, including a package update.

Evidence against

Local installs exit without changing system services.
The portal path requires a stored node token and accepts only two fixed actions.
The update command binds npm to the configured registry and disables lifecycle scripts.
The inspected Highway and UI files contain monitoring and display code, not a hidden payload.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 0 B of source

Source & flagged code

10 flagged

package.jsonView file

Lines 1-41json

2 "name": "hyn-view",

3 "version": "1.9.0",

4 "description": "Network-first, ultra-low-overhead terminal system monitor for Ubuntu Server. Pure bash, zero runtime dependencies, themeable, with email/push alerting, daily reports, scheduled speed tests and read-only Highway (hw-os) node tracking.",

5 "bin": {

6 "hyn": "bin/hyn",

7 "hyn-view": "bin/hyn"

8 },

9 "files": [

10 "bin/",

11 "lib/",

12 "scripts/",

13 "themes/",

14 "test/",

15 "docs/local-storage-and-hosting.md",

16 "docs/cli-release-readiness.md",

17 "README.md",

18 "LICENSE"

19 ],

20 "scripts": {

21 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh && bash test/local-storage.sh && bash test/unattended.sh && bash test/bandwidth.sh && bash test/release-reliability.sh && bash test/report-reliability.sh",

23 "test:db": "bash supabase/run-tests.sh"

Medium

Suspicious Lifecycle Evidence

The install hook runs automatically after npm installation.

package.jsonView on unpkg · L20

24 },

25 "keywords": [

26 "alerting",

27 "bandwidth",

28 "bash",

29 "btop",

30 "daily-report",

31 "devops",

32 "email-alerts",

33 "highway",

34 "htop",

35 "hwaynetwork",

36 "monitor",

37 "network",

38 "node-operator",

39 "notifications",

40 "ntfy",

41 "proc",

test/bandwidth.shView file

•path = test/bandwidth.sh kind = payload_in_excluded_dir sizeBytes = 3906 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/bandwidth.shView on unpkg

•path = test/bandwidth.sh kind = build_helper sizeBytes = 3906 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/bandwidth.shView on unpkg

bin/hynView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/hynView on unpkg

lib/highway.shView file

•matchType = normalized_sha256 matchedPackage = hyn-view@1.8.0 matchedPath = lib/highway.sh matchedIdentity = npm:aHluLXZpZXc:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/highway.shView on unpkg

lib/ui.shView file

•matchType = normalized_sha256 matchedPackage = hyn-view@1.8.0 matchedPath = lib/ui.sh matchedIdentity = npm:aHluLXZpZXc:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/ui.shView on unpkg

scripts/postinstall.shView file

Lines 27-67text

28set -u

30# Never let a monitoring tool's own setup break `npm install`.

31trap 'exit 0' ERR

33say() { printf 'hyn-view: %s\n' "$1"; }

35[[ ${HYN_NO_POSTINSTALL:-} == 1 ]] && { say 'postinstall skipped (HYN_NO_POSTINSTALL=1)'; exit 0; }

37# A local dependency install must not reconfigure the machine. npm sets this for

38# `-g`; when it is absent, assume local and do nothing.

39case ${npm_config_global:-} in

lib/setup.shView file

Lines 620-660text

620

621 # Wake every minute to pull account settings quickly. `hyn push --scheduled`

622 # performs the full telemetry collection only when cloud_push_min is due, so

623 # the managed ten-minute default does not run expensive probes every minute.

624 #

625 # Timeout is 120s, not the shared 180s: the portal calls a node quiet after

626 # three missed minutes, so one run allowed to hang for the full 180s would

627 # trip that warning by itself. 120s leaves a whole spare interval.

628 _write_unit "$HYN_UNIT_DIR/hyn-push.service" \

629 "$(_generic_service 'hyn-view web portal push' "$exe push --scheduled" '' 120)"

630 # No jitter and 1s accuracy on this one. Jitter exists to stop a fleet

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

20"scripts": { "postinstall": "bash scripts/postinstall.sh", "test": "bash test/selfcheck.sh && bash test/cloud-integration.sh && bash test/update-workflow.sh && bash test/local-storage.sh && bash test/unattended.sh && bash test/bandwidth.sh && bash test/release-reliability.sh && bash test/report-reliability.sh", "test:db": "bash supabase/run-tests.sh"

Medium

Suspicious Lifecycle Evidence

The install hook runs automatically after npm installation.

package.jsonView on unpkg · L20

test/bandwidth.sh

Findings

5 High6 Medium1 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirtest/bandwidth.sh

HighSemantic Analysis Limitedbin/hyn

HighKnown Malware Source Similaritylib/highway.sh

HighKnown Malware Source Similaritylib/ui.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Build Helpertest/bandwidth.sh

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencescripts/postinstall.sh

MediumAi Review Evidencelib/setup.sh

LowScripts Present

Affected versions and remediation

This report applies to hyn-view@1.9.0.

See all versions of hyn-view for other recorded verdicts.

Review the evidence and your use of hyn-view@1.9.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 19:31:47.200Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code