registry / AI-agent control-surface risk / hyper-animator
hyper-animator
Claude Code skill for HyperFrames animation pipeline — natural language to rendered video
This report shows the evidence for hyper-animator@2.15.1. 7 of 13 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package performs concrete install-time writes to the user's Claude skill directory and executes follow-on tooling. That meets the firewall block boundary for unconsented postinstall mutation of a foreign/broad AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
`npm install` / dependency installation
Impact
Unconsented persistent AI-agent instruction and tool-surface modification; install-time external catalog retrieval.
Mechanism
postinstall drops and activates a Claude skill under the user home directory
Policy narrative
Installing the package automatically copies a package-supplied Claude Code skill, instructions, and executable helpers into `~/.claude/skills/hyper-animator`, creates a configuration file, and rewrites the installed skill metadata. The same postinstall then runs the copied catalog-sync helper, which invokes `hyperframes` to fetch catalog content. This is an unconsented postinstall mutation of a broad AI-agent control surface.
AI rationale
The package performs concrete install-time writes to the user's Claude skill directory and executes follow-on tooling. That meets the firewall block boundary for unconsented postinstall mutation of a foreign/broad AI-agent control surface.
Evidence
package.jsoninstall.jsskills/hyper-animator/SKILL.mdskills/hyper-animator/scripts/sync-catalog.pyskills/hyper-animator/~/.claude/skills/hyper-animator/~/.claude/skills/hyper-animator/.env~/.claude/skills/hyper-animator/SKILL.md~/.claude/skills/hyper-animator/scripts/sync-catalog.py
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- `package.json` runs `node install.js` as `postinstall`.
- `install.js` unconditionally copies package content into `~/.claude/skills/hyper-animator`.
- `install.js` writes `~/.claude/skills/hyper-animator/.env` during install.
- `install.js` rewrites installed `SKILL.md` frontmatter.
- Postinstall executes copied `sync-catalog.py`, which invokes the external `hyperframes` CLI.
Evidence against
- No credential exfiltration found in the inspected installer.
- MiniMax API calls are in explicit generation helpers, not the installer.
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkginstall.jsView file
12Install-time AI-agent control hijack evidence:
L12: const home = os.homedir();
L13: const destDir = path.join(home, '.claude', 'skills', 'hyper-animator');
L14: const srcDir = path.join(__dirname, 'skills', 'hyper-animator');
...
L38: function copyDir(src, dest) {
L39: if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true });
L40: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L43: if (entry.isDirectory()) { copyDir(s, d); }
L44: else { fs.copyFileSync(s, d); if (entry.name.endsWith('.sh')) fs.chmodSync(d, 0o755); }
L45: }
...
L57: }
L58: if (added > 0) fs.writeFileSync(envPath, content);
L59: return { envPath, added };
Payload evidence from skills/hyper-animator/SKILL.md:
L26:
L27: Display as: `hyper-animator v<version> (commit <commit>)` in the first me
Findings
1 Critical3 High3 Medium4 Low
CriticalAi Agent Control Hijackinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall.js
HighKnown Malware Source Fingerprint Signatureinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Build Helperskills/hyper-animator/scripts/lint-html.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to hyper-animator@2.15.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing hyper-animator@2.15.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
13 known versions2.15.1latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 11, 2026, 6:01 AM2.15.0MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 11, 2026, 2:30 AM2.10.0SuspiciousAgent extension lifecycle riskWarnPublishedJul 6, 2026, 4:14 AM2.9.0MaliciousSoft block: AI-agent control surfaceBlockPublished