hyperframes@r2

CAUTION

Publisher claims: "Read first to make, edit, animate or render any video with HyperFrames (HTML rendered to video), including launch films, explainers, music videos, charts, maps, vertical clips, title cards, captions and overlays. Holds the render contract, the work loop and what each kind of video needs." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher heygen-com · joined 2 days agoInstalls 1.2MLast detonated 19 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

URL with embedded credentialsassets/frame-presets/biennale-yellow/frame-showcase.html:683 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/blue-professional/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packageSKILL.md:18 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/blockframe/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/bold-poster/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/biennale-yellow/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/blockframe/frame-showcase.html:790 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/blockframe/frame-showcase.html:786 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/blue-professional/frame-showcase.html:823 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/blue-professional/frame-showcase.html:827 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packageSKILL.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/biennale-yellow/frame-showcase.html:687 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packageSKILL.md:10 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/broadside/frame-showcase.html:687 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/film.md:28 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/cobalt-grid/frame-showcase.html:746 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/film.md:14 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commandreferences/captions.md:21 · Process kill command — agent can terminate processes

AST05

HIGH

URL with embedded credentialsassets/frame-presets/capsule/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/editorial-forest/frame-showcase.html:735 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/daisy-days/frame-showcase.html:755 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/captions.md:5 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/coral/frame-showcase.html:761 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/cobalt-grid/frame-showcase.html:742 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/cartesian/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/captions.md:6 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/film.md:33 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/daisy-days/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/daisy-days/frame-showcase.html:751 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/editorial-forest/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/bold-poster/frame-showcase.html:662 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/broadside/frame-showcase.html:691 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/coral/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/broadside/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/creative-mode/frame-showcase.html:763 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/captions.md:15 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/capsule/frame-showcase.html:737 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/cartesian/frame-showcase.html:765 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/code-editorial/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/cobalt-grid/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/editorial-forest/frame-showcase.html:731 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/captions.md:43 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsassets/frame-presets/cartesian/frame-showcase.html:761 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/capsule/frame-showcase.html:733 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

URL with embedded credentialsassets/frame-presets/creative-mode/frame-showcase.html:10 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packagereferences/skill-lifecycle.md:22 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/review.md:10 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/motion.md:69 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/plugin-installation.md:18 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionreferences/look.md:15 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagereferences/sound.md:15 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/plugin-installation.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/motion.md:70 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/motion.md:63 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/skill-lifecycle.md:8 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/skill-lifecycle.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/format.md:3 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/skill-lifecycle.md:21 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/look.md:15 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/look.md:16 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/review.md:8 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/format.md:109 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/motion.md:71 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/storyboard.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/motion.md:44 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/runtimes.md:3 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/review.md:7 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/sound.md:43 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/skill-lifecycle.md:23 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/sound.md:36 · npx invocation of non-well-known package — may execute untrusted code

AST06