Loading npm security reports…

hyprkit-cli@0.1.1: AI-agent control-surface risk | LPM Firewall

registry / hyprkit-cli / 0.1.1

hyprkit-cli@0.1.1

Install and update the hyprkit Claude Code kit — agents, skills, hooks and rules — per project or globally.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation mutates existing Claude configuration in the consumer project and home directory. It then noninteractively invokes the package CLI to restore hooks and install skills.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package runs npm postinstall.

Impact

Existing Claude Code control settings can be changed and package-managed hooks and skills can be installed without an explicit user command.

Mechanism

Automatic broad AI-agent configuration mutation and hook restoration.

Policy narrative

On installation, package.json runs the self-healing script. That script locates both consumer-project and global Claude settings, edits hook entries, and calls a helper. The helper starts the package CLI with automatic confirmation, hook restoration, and skill installation flags. This is an unconsented postinstall mutation of a broad AI-agent control surface.

AI rationale

The automatic postinstall path modifies foreign project and global Claude settings and reinstalls hooks and skills noninteractively. This meets the install-hook abuse blocking criterion even though the inspected lifecycle scripts do not exfiltrate data.

Evidence

package.jsonbin/postinstall-self-heal.cjsbin/postinstall-hook-restore.cjs.claude/settings.json.claude/settings.local.json~/.claude/settings.json~/.claude/settings.local.json~/.ccs/*

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall-self-heal.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/postinstall-hook-restore.cjsView file

6const path = require("node:path"); L7: const { spawnSync } = require("node:child_process"); L8:

High

Child Process

Package source references child process execution.

bin/postinstall-hook-restore.cjsView on unpkg · L6

dist/index.jsView file

129var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsianWidth = function(t) { L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s; L472: retur

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L129

129var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsianWidth = function(t) { L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s; L472: retur

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/index.jsView on unpkg · L129

44823L44824: // node_modules/powershell-utils/index.js L44825: import process11 from "node:process";

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L44823

129var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsianWidth = function(t) { L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s; L472: retur

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L129

129var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsianWidth = function(t) { L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s; L472: retur

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L129

1871if (!fs[gracefulQueue]) { L1872: queue = global[gracefulQueue] || []; L1873: publishQueue(fs, queue);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1871

10645matter.read = function(filepath, options2) { L10646: const str2 = fs.readFileSync(filepath, "utf8"); L10647: const file = matter(str2, options2); ... L10898: }); L10899: import { execFileSync } from "node:child_process"; L10900: import { existsSync, readdirSync, statSync } from "node:fs"; ... L16018: description: exports_external.string().optional(), L16019: baseUrl: exports_external.string().optional(), L16020: timeout: exports_external.number().optional(),

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/index.jsView on unpkg · L10645

129Detached bundled service listener: dist/index.js launches a Node helper and exposes a broad-bound HTTP listener. L129: var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsia

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/index.jsView on unpkg · L129

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.jsView on unpkg

bin/postinstall-self-heal.cjsView file

79if (pruned > 0) { L80: fs.writeFileSync(filePath, `${JSON.stringify(settings, null, 2)}\n`); L81: } ... L107: if (initCwd && path.isAbsolute(initCwd)) { L108: addIfSettingsFile(files, path.join(initCwd, ".claude", "settings.json")); L109: addIfSettingsFile(files, path.join(initCwd, ".claude", "settings.local.json")); L110: } ... L112: const homeDir = getHomeDir(); L113: const globalClaudeDir = process.env.CLAUDE_CONFIG_DIR || path.join(homeDir, ".claude"); L114: addIfSettingsFile(files, path.join(globalClaudeDir, "settings.json"));

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall-self-heal.cjsView on unpkg · L79

3L4: const fs = require("node:fs"); L5: const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/postinstall-self-heal.cjsView on unpkg · L3

Source & flagged code

13 flagged

package.jsonView file

Lines 33-73json

33 "build": "bun build src/index.ts --outdir dist --target node --external @octokit/rest --external better-sqlite3 && node -e \"const fs=require('fs'),f='dist/index.js',c=fs.readFileSync(f,'utf-8');fs.writeFileSync(f,c.replace(/^#!.*\\n\\/\\/ @bun\\n/,''))\"",

34 "verify:package": "node scripts/prepublish-check.js",

35 "test": "bun test",

36 "test:integration": "CK_RUN_CLI_INTEGRATION=1 bun test tests/integration/cli.test.ts",

37 "test:watch": "bun test --watch",

38 "test:quick": "./scripts/dev-quick-start.sh test",

39 "test:e2e": "playwright test --config=playwright.config.ts",

40 "test:e2e:ui": "playwright test --ui --config=playwright.config.ts",

41 "lint": "biome check .",

42 "lint:fix": "biome check --fix .",

43 "lint:fix-unsafe": "biome check --fix --unsafe .",

44 "format": "biome format --write .",

45 "typecheck": "tsc --noEmit",

46 "dev:quick": "./scripts/dev-quick-start.sh",

47 "dev:all": "./scripts/dev-quick-start.sh all",

48 "metrics": "bun run scripts/workflow-metrics.ts",

49 "validate": "bun run typecheck && bun run lint && bun test && bun run ui:test && bun run build",

50 "ci:local": "bash scripts/ci-local.sh",

51 "install:hooks": "./.githooks/install.sh",

52 "prepare": "node -e \"try{require('child_process').execSync('git rev-parse --git-dir',{stdio:'ignore'});require('child_process').execSync('bash .githooks/install.sh',{stdio:'inherit'})}catch(e){console.warn('[i] Hook install skipped:',e.message)}\"",

53 "postinstall": "node bin/postinstall-self-heal.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

54 "help:check-parity": "bun run scripts/check-help-parity.ts",

55 "manifest:generate": "bun run scripts/generate-cli-manifest.ts",

56 "docs:generate": "bun run scripts/generate-cli-reference.ts",

57 "prepublishOnly": "bun run build"

58 },

59 "keywords": [

60 "cli",

61 "hyprkit",

62 "claude-code",

63 "boilerplate",

64 "bootstrap"

65 ],

66 "author": "Phan Cong Long",

67 "license": "MIT",

68 "engines": {

69 "node": ">=18.0.0"

70 },

71 "dependencies": {

72 "@clack/prompts": "^0.7.0",

73 "@octokit/rest": "^22.0.0",

bin/postinstall-hook-restore.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("node:fs");

5const os = require("node:os");

dist/index.jsView file

129var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsianWidth = function(t) { L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s; L472: retur

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L129

129var env = p.env || {}; L130: var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env... L131: var formatter = (open, close, replace = open) => (input) => { ... L301: this._track && (this.value = this.rl.line.replace(/\t/g, ""), this._cursor = this.rl.cursor, this.emit("value", this.value)), s(); L302: }, this.input.pipe(u), this.rl = _.createInterface({ input: this.input, output: u, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), _.emitKeypressEvents(this.input, this.rl), this... L303: this.once("submit", () => { ... L470: e.exports = u, u.eastAsianWidth = function(t) { L471: var s = t.charCodeAt(0), C = t.length == 2 ? t.charCodeAt(1) : 0, D = s; L472: retur

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/index.jsView on unpkg · L129

bin/postinstall-self-heal.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

3

4const fs = require("node:fs");

5const os = require("node:os");