registry / AI-agent control-surface risk / hyperqe
hyperqe
HyperQE — AI-native Quality Engineering orchestration for Cursor, Claude Code, and GitHub Copilot
This report shows the evidence for hyperqe@9.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source establishes unconsented postinstall mutation of broad AI-agent control surfaces, meeting the supplied blocking policy. The other inspected scanner hints do not establish credential theft or hidden payload execution.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package with lifecycle scripts enabled and automatic bootstrap not explicitly disabled.
Impact
Future agent sessions can load package-provided instructions, MCP configuration, and command hooks without separate setup consent.
Mechanism
The installer resolves INIT_CWD and recursively copies package seed paths into the consumer project without an approval prompt.
Policy narrative
Installing hyperqe activates a default-enabled postinstall bootstrap. It copies missing files into the consumer project's agent instruction and configuration locations, including Claude settings that register a command hook. Preserving existing files and offering an environment-variable opt-out do not provide prior consent for creating these broad agent control surfaces.
AI rationale
Inspected source establishes unconsented postinstall mutation of broad AI-agent control surfaces, meeting the supplied blocking policy. The other inspected scanner hints do not establish credential theft or hidden payload execution.
Evidence
package.json.hyperqe/scripts/bootstrap-project.mjs.claude/settings.jsonAGENTS.md.claude.cursor.codex.github/copilot-instructions.md.github/prompts.github/agents.mcp.json.vscode/mcp.json
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json automatically runs bootstrap-project.mjs during postinstall.
- Bootstrap targets broad agent control surfaces, including AGENTS.md, .claude, .cursor, .codex, and MCP configuration.
- Automatic bootstrap defaults to enabled and targets INIT_CWD without requesting consent.
- The copy routine preserves existing files but creates missing configuration files.
- Bootstrap invokes that copy routine for every configured seed path.
- The seeded Claude settings register a command hook after agent Write or Edit operations.
Evidence against
- Existing destination files are preserved, and HQE_AUTO_BOOTSTRAP=false disables automatic seeding.
- The independent-audit.mjs target reads agent wrapper files to check their presence.
- setup-cursor.ps1 contains ordinary setup commands; the flagged password in vf1.1.selftest.mjs is test data.
Behavioral surface
Filesystem
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node .hyperqe/scripts/bootstrap-project.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg.hyperqe/scripts/vf1/vf1.1.selftest.mjsView file
264patternName = generic_password
severity = medium
line = 264
Medium
Secret Pattern
Package contains a possible secret pattern.
.hyperqe/scripts/vf1/vf1.1.selftest.mjsView on unpkg · L264.hyperqe/scripts/bootstrap-project.mjsView file
21'.cursor',
L22: '.claude',
L23: '.codex',
L24: '.github/workflows/validate.yml',
...
L27: '.github/agents',
L28: '.mcp.json',
L29: '.vscode/mcp.json',
L30: 'AGENTS.md',
L31: ];
...
L95: await fs.ensureDir(path.dirname(dst));
L96: await fs.copyFile(src, dst);
L97: copied.copied += 1;
Findings
1 Critical2 High11 Medium2 Low
CriticalAi Agent Control Hijack.hyperqe/scripts/bootstrap-project.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dir.hyperqe/scripts/setup-cursor.ps1
MediumSecret Pattern.hyperqe/scripts/vf1/vf1.1.selftest.mjs
MediumShips Build Helper.hyperqe/scripts/setup-cursor.ps1
MediumStructural Risk Force Deep Review
MediumSecret Pattern.hyperqe/scripts/vf1/vf1.selftest.mjs
MediumSecret Pattern.hyperqe/scripts/vf1/vf1.selftest.mjs
MediumSecret Pattern.hyperqe/scripts/p2-2-runtime-selftest.mjs
MediumSecret Pattern.hyperqe/validation-framework/vf2.1/benchmark.mjs
MediumSecret Pattern.hyperqe/frameworks/webdriverio/patterns/screen-platform.example.mjs
Affected versions and remediation
This report applies to hyperqe@9.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing hyperqe@9.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.