registry  /  hyper-animator  /  2.9.0

hyper-animator@2.9.0

⚠ Under review

Claude Code skill for HyperFrames animation pipeline — natural language to rendered video

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 5.78 KB of source, external domains: platform.minimaxi.com

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
install.jsView file
12Install-time AI-agent control hijack evidence: L12: const home = os.homedir(); L13: const destDir = path.join(home, '.claude', 'skills', 'hyper-animator'); L14: const srcDir = path.join(__dirname, 'skills', 'hyper-animator'); ... L38: function copyDir(src, dest) { L39: if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true }); L40: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L43: if (entry.isDirectory()) { copyDir(s, d); } L44: else { fs.copyFileSync(s, d); if (entry.name.endsWith('.sh')) fs.chmodSync(d, 0o755); } L45: } ... L57: } L58: if (added > 0) fs.writeFileSync(envPath, content); L59: return { envPath, added }; Payload evidence from skills/hyper-animator/SKILL.md: L26: L27: Display as: `hyper-animator v<version> (commit <commit>)` in the first message to the user. Example: `hyper-animator v1.10.1 (f6b3697)`. This helps with debugging — knowing exactly... L28: ... L144: |---------|---------------| L145: | Beat JSON generated | `data: beat detection — <composition-name>` | L146: | BGM/SFX files generated | `asset: audio generated via <source>` | ... L912: - WAV format, 32kHz mono, compatible with HyperFrames `<audio>` element L913: - Exit…
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

install.jsView on unpkg · L12
•matchType = normalized_sha256 matchedPackage = hyper-animator@2.6.1 matchedPath = install.js matchedIdentity = npm:aHlwZXItYW5pbWF0b3I:2.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

install.jsView on unpkg
•matchType = malicious_source_fingerprint_signature signature = b0844b69ce469f04 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hyper-animator@2.6.1 matchedPath = install.js matchedIdentity = npm:aHlwZXItYW5pbWF0b3I:2.6.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

install.jsView on unpkg
skills/hyper-animator/scripts/preview-gen.pyView file
•path = skills/hyper-animator/scripts/preview-gen.py kind = build_helper sizeBytes = 11136 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hyper-animator/scripts/preview-gen.pyView on unpkg

Findings

1 Critical3 High3 Medium4 Low
CriticalAi Agent Control Hijackinstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityinstall.js
HighKnown Malware Source Fingerprint Signatureinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Build Helperskills/hyper-animator/scripts/preview-gen.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings