registry / AI-agent control-surface risk / @arihantdeva/heimdall

@arihantdeva/heimdall

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

This report shows the evidence for @arihantdeva/heimdall@0.12.4. 9 of 12 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Inspected source proves unconsented postinstall mutation of foreign, user-wide AI-agent control surfaces. This meets the blocking policy regardless of source-similarity scanner labels.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled unless HEIMDALL_NO_AUTOINIT=1.

Impact

Future agent sessions inherit package-imposed retrieval rules and MCP command registrations.

Mechanism

The postinstall hook detects agent directories, invokes quiet setup, and reaches adapters that write user-wide configuration and instructions.

Policy narrative

The automatic install hook discovers existing AI-agent installations and silently invokes their configuration writers. For Codex, this registers a package MCP server and appends mandatory retrieval instructions to the user's AGENTS.md. These changes affect subsequent agent behavior outside the package's own configuration. An opt-out environment variable does not establish affirmative consent for this default install-time mutation.

AI rationale

Inspected source proves unconsented postinstall mutation of foreign, user-wide AI-agent control surfaces. This meets the blocking policy regardless of source-similarity scanner labels.

Evidence

package.jsonbin/postinstall.mjsbin/heimdall.jsbin/lib/cli-main.mjsbin/lib/adapters.mjsbin/lib/enforcement-rules.mjs.codex/config.tomlAGENTS.md.pi/agent/AGENTS.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

package.json automatically runs bin/postinstall.mjs after installation.
The install hook detects existing agent configurations and invokes quiet setup for each without a consent prompt.
bin/heimdall.js forwards arguments to the CLI, whose setup function directly invokes the adapter writer.
The Codex adapter writes MCP configuration and appends rules to the user's AGENTS.md; the indicated Pi location also appends agent rules.
The installed rules require memory queries before implementation and redirect code discovery across repositories.

Evidence against

An environment variable can disable automatic setup, but setup runs by default.
Configuration writers preserve unrelated settings; no credential exfiltration was established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

12 flagged

package.jsonView file

Lines 49-77json

49 "docs/assets/",

50 "README.md",

51 "LICENSE",

52 "vendor/graft/",

53 "!vendor/graft/build/",

54 "!vendor/graft/third_party/llama.cpp/",

55 "!vendor/graft/models/",

56 "!vendor/graft/**/*.db",

57 "!vendor/graft/**/*.db-shm",

58 "!vendor/graft/**/*.db-wal",

59 "vendor/graphify/",

60 "!vendor/graphify/**/__pycache__/"

61 ],

62 "engines": {

63 "node": ">=22.5"

64 },

65 "type": "module",

66 "scripts": {

67 "test": "node --test \"tests/**/*.test.mjs\"",

68 "typecheck": "tsc --noEmit",

69 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L69

70 },

71 "devDependencies": {

72 "@types/node": "^22.0.0",

73 "typebox": "^1.3.0",

74 "typescript": "^5.6.0"

75 }

76}

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/setup.mjsView file

Lines 1-27javascript

1// setup.mjs — `heimdall setup`: hardware-aware config generation + daemon install.

2//

3// Detects the machine (accelerator, cores), renders an annotated

4// ~/.graft/config.yaml for the graft C++ daemon, optionally downloads an

5// embedding model, and installs/repairs the launchd daemon. Pure helpers

6// (detectHardware, renderConfig, parseSetupArgs) are exported for tests;

7// runSetup() is the CLI entry.

8import { execFileSync } from "node:child_process";

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. return join(pkgroot(), "bin", "heimdall.js"); } function writepi(home) { const npmroots = [join(home, ".pi", "agent", "npm", "node_modules"), join(home, ".pi", "npm", "node_modules")]; for (con

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/lib/graft-build.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lib/graft-build.mjs#virtual:normalized:round1View on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

Findings

9 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/lib/index-bootstrap.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/lib/adapters.mjs

HighTrigger Reachable Persistencebin/lib/setup.mjs

HighRuntime Package Installbin/lib/index-bootstrap.mjs

HighSemantic Analysis Limitedbin/lib/graft-build.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritybin/lib/setup.mjs

HighKnown Malware Source Similaritybin/postinstall.mjs

HighKnown Malware Source Similarityextensions/kb-tools.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

Affected versions and remediation

This report applies to @arihantdeva/heimdall@0.12.4.

The versions list below shows the verdict for each recorded version.

Avoid installing @arihantdeva/heimdall@0.12.4. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-02 00:01:43.870Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

12 known versions

0.12.4latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 19, 2026, 8:51 PM 0.12.3MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 19, 2026, 8:36 PM 0.12.1MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 18, 2026, 11:12 PM 0.12.0MaliciousSoft block: AI-agent control surfaceBlock

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code