registry / AI-agent control-surface risk / hyprkit-cli
hyprkit-cli
Install and update the hyprkit Claude Code kit — agents, skills, hooks and rules — per project or globally.
This report shows the evidence for hyprkit-cli@0.1.1, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic postinstall path modifies foreign project and global Claude settings and reinstalls hooks and skills noninteractively. This meets the install-hook abuse blocking criterion even though the inspected lifecycle scripts do not exfiltrate data.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package runs npm postinstall.
Impact
Existing Claude Code control settings can be changed and package-managed hooks and skills can be installed without an explicit user command.
Mechanism
Automatic broad AI-agent configuration mutation and hook restoration.
Policy narrative
On installation, package.json runs the self-healing script. That script locates both consumer-project and global Claude settings, edits hook entries, and calls a helper. The helper starts the package CLI with automatic confirmation, hook restoration, and skill installation flags. This is an unconsented postinstall mutation of a broad AI-agent control surface.
AI rationale
The automatic postinstall path modifies foreign project and global Claude settings and reinstalls hooks and skills noninteractively. This meets the install-hook abuse blocking criterion even though the inspected lifecycle scripts do not exfiltrate data.
Evidence
package.jsonbin/postinstall-self-heal.cjsbin/postinstall-hook-restore.cjs.claude/settings.json.claude/settings.local.json~/.claude/settings.json~/.claude/settings.local.json~/.ccs/*
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package automatically runs its self-healing script during npm postinstall.
- The postinstall script selects project and global Claude settings files and rewrites them without a user command.
- The lifecycle helper launches the CLI with noninteractive flags to restore hooks and install skills.
Evidence against
- No credential collection or network transmission is present in the inspected lifecycle scripts.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
WildcardDependency
Oversized source lightweight scan
Source & flagged code
13 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/postinstall-self-heal.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/postinstall-hook-restore.cjsView file
6const path = require("node:path");
L7: const { spawnSync } = require("node:child_process");
L8:
High
Child Process
Package source references child process execution.
bin/postinstall-hook-restore.cjsView on unpkg · L6dist/index.jsView file
129var env = p.env || {};
L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env...
L131: var formatter = (open, close, replace = open) => (input) => {
...
L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s();
L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this...
L303: this.once("submit", () => {
...
L470: e.exports = u, u.eastAsianWidth = function(t) {
L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s;
L472: retur
Findings
3 Critical9 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalReverse Shelldist/index.js
CriticalAi Agent Control Hijackbin/postinstall-self-heal.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/postinstall-hook-restore.cjs
HighShelldist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighObfuscated Payload Loaderdist/index.js
HighRemote Agent Bridgedist/index.js
HighSpawned Bundled Service Listenerdist/index.js
HighSemantic Analysis Limiteddist/index.js
Affected versions and remediation
This report applies to hyprkit-cli@0.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing hyprkit-cli@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.