Loading npm security reports…

@arihantdeva/heimdall@0.12.0: AI-agent control-surface risk | LPM Firewall

registry / @arihantdeva/heimdall / 0.12.0

@arihantdeva/heimdall@0.12.0

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies detected third-party AI agents' control surfaces without affirmative consent. It registers tools, installs hooks, and adds mandatory behavioral instructions.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, unless HEIMDALL_NO_AUTOINIT is set to 1.

Impact

Future agent sessions load package tools and follow package-imposed retrieval and recording rules.

Mechanism

The install script invokes quiet initialization; the CLI dispatches to adapters that write agent configuration and instruction files.

Policy narrative

The npm install hook detects existing AI agents and silently runs initialization for each. Initialization writes tool registrations, executable hooks, plugins, and mandatory memory-first instructions into those agents' configuration. Detection and preserving unrelated settings do not constitute consent to changing agent behavior.

AI rationale

Inspected source establishes unconsented postinstall mutation of foreign AI-agent control surfaces, meeting the blocking policy. Citation issuance repeatedly failed because the tool transport closed; no citation IDs were invented.

Evidence

package.jsonbin/postinstall.mjsbin/heimdall.jsbin/lib/cli-main.mjsbin/lib/adapters.mjsbin/lib/enforcement-rules.mjs.claude/settings.json.claude/CLAUDE.md.codex/config.toml

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

66if (!hasGraft) { L67: results.push({ repo, status: "skipped", detail: "graft unavailable — npm i -g @nanonets/graft" }); L68: continue; ... L70: try { L71: const r = spawnSync("graft", ["build"], { cwd: repo, stdio: "ignore", timeout: 120_000 }); L72: if (r.status !== 0 || r.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/index-bootstrap.mjsView on unpkg · L66

bin/lib/setup.mjsView file

7Trigger-reachable persistence chain: scripts.postinstall -> bin/postinstall.mjs -> bin/lib/setup.mjs L7: // runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/lib/setup.mjsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/lib/setup.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/setup.mjsView on unpkg

7// runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. return join(pkgroot(), "bin", "heimdall.js"); } function writepi(home) { const npmroots = [join(home, ".pi", "agent", "npm", "node_modules"), join(home, ".pi", "npm", "node_modules")]; for (con

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 46-74json

46 "docs/adapters.md",

47 "README.md",

48 "LICENSE",

49 "vendor/graft/",

50 "!vendor/graft/build/",

51 "!vendor/graft/third_party/llama.cpp/",

52 "!vendor/graft/models/",

53 "!vendor/graft/**/*.db",

54 "!vendor/graft/**/*.db-shm",

55 "!vendor/graft/**/*.db-wal",

56 "vendor/graphify/",

57 "!vendor/graphify/**/__pycache__/"

58 ],

59 "engines": {

60 "node": ">=22.5"

61 },

62 "type": "module",

63 "scripts": {

64 "test": "node --test \"tests/**/*.test.mjs\"",

65 "typecheck": "tsc --noEmit",

66 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L66

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L66

67 },

68 "devDependencies": {

69 "@types/node": "^22.0.0",

70 "typebox": "^1.3.0",

71 "typescript": "^5.6.0"

72 }

73}

74

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/setup.mjsView file

Lines 1-27javascript

1// setup.mjs — `heimdall setup`: hardware-aware config generation + daemon install.

2//

3// Detects the machine (accelerator, cores), renders an annotated

4// ~/.graft/config.yaml for the graft C++ daemon, optionally downloads an

5// embedding model, and installs/repairs the launchd daemon. Pure helpers

6// (detectHardware, renderConfig, parseSetupArgs) are exported for tests;

7// runSetup() is the CLI entry.

8import { execFileSync } from "node:child_process";

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. return join(pkgroot(), "bin", "heimdall.js"); } function writepi(home) { const npmroots = [join(home, ".pi", "agent", "npm", "node_modules"), join(home, ".pi", "npm", "node_modules")]; for (con

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg