Loading npm security reports…

@arihantdeva/heimdall@0.10.0: AI-agent control-surface risk | LPM Firewall

registry / @arihantdeva/heimdall / 0.10.0

@arihantdeva/heimdall@0.10.0

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package automatically modifies detected AI-agent configurations and hooks. It also starts a detached home-directory repository indexer.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Detected Claude Code, Codex, Cursor, OpenCode, Gemini, DeepSeek, and Pi installations can execute or be instructed to use package-controlled components without user consent.

Mechanism

Automatic AI-agent control-surface mutation and detached repository indexing

Policy narrative

Installing the package invokes postinstall. That script identifies agent harness directories under the user home directory, then runs initialization for every detected harness. The initialization writes MCP registrations, command hooks, extensions, and instruction files into foreign agent control surfaces. The same lifecycle script starts a detached process that discovers repositories beneath the home directory and indexes them. These actions occur without an explicit setup command or informed consent.

AI rationale

The automatic postinstall chain mutates broad, foreign AI-agent control surfaces and launches persistent background indexing. This meets the install-hook abuse blocking policy even though direct network exfiltration was not established.

Evidence

package.jsonbin/postinstall.mjsbin/lib/adapters.mjsbin/lib/index-bootstrap.mjs~/.claude/settings.json~/.claude/CLAUDE.md

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

66if (!hasGraft) { L67: results.push({ repo, status: "skipped", detail: "graft unavailable — npm i -g @nanonets/graft" }); L68: continue; ... L70: try { L71: const r = spawnSync("graft", ["build"], { cwd: repo, stdio: "ignore", timeout: 120_000 }); L72: if (r.status !== 0 || r.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/index-bootstrap.mjsView on unpkg · L66

bin/lib/extract.mjsView file

24".php": "php", ".swift": "swift", ".lua": "lua", ".zig": "zig", L25: ".ps1": "powershell", ".ex": "elixir", ".exs": "elixir", L26: ".m": "objc", ".mm": "objc", ".jl": "julia",

High

Shell

Package source references shell execution.

bin/lib/extract.mjsView on unpkg · L24

bin/lib/setup.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.481 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/setup.mjsView on unpkg

7Trigger-reachable persistence chain: scripts.postinstall -> bin/postinstall.mjs -> bin/lib/setup.mjs L7: // runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/lib/setup.mjsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = bin/lib/setup.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-orient.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = extensions/kb-orient.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-orient.tsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 34-62json

34 "types/",

35 "config/",

36 "docs/adapters.md",

37 "README.md",

38 "LICENSE",

39 "vendor/graft/",

40 "!vendor/graft/build/",

41 "!vendor/graft/third_party/llama.cpp/",

42 "!vendor/graft/models/",

43 "!vendor/graft/**/*.db",

44 "!vendor/graft/**/*.db-shm",

45 "!vendor/graft/**/*.db-wal"

46 ],

47 "engines": {

48 "node": ">=22.5"

49 },

50 "type": "module",

51 "scripts": {

52 "test": "node --test \"tests/**/*.test.mjs\"",

53 "typecheck": "tsc --noEmit",

54 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "devDependencies": {

57 "@types/node": "^22.0.0",

58 "typebox": "^1.3.0",

59 "typescript": "^5.6.0"

60 }

61}

62

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/extract.mjsView file

Lines 4-44javascript

4// produce the same node/edge set. That property is what makes reconcile

5// idempotent, and therefore what makes concurrent edits harmless.

6import { execFileSync } from "node:child_process";

7import { createHash } from "node:crypto";

8import { readFileSync, statSync } from "node:fs";

bin/lib/setup.mjsView file

Lines 1-27javascript

1// setup.mjs — `heimdall setup`: hardware-aware config generation + daemon install.

2//

3// Detects the machine (accelerator, cores), renders an annotated

4// ~/.graft/config.yaml for the graft C++ daemon, optionally downloads an

5// embedding model, and installs/repairs the launchd daemon. Pure helpers

6// (detectHardware, renderConfig, parseSetupArgs) are exported for tests;

7// runSetup() is the CLI entry.

8import { execFileSync } from "node:child_process";

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-orient.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = extensions/kb-orient.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-orient.tsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.9.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg