Loading npm security reports…

@arihantdeva/heimdall@0.12.4: AI-agent control-surface risk | LPM Firewall

registry / @arihantdeva/heimdall / 0.12.4

@arihantdeva/heimdall@0.12.4

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies foreign AI-agent control surfaces. It registers package commands and installs behavior-changing rules without affirmative consent.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation with lifecycle scripts enabled unless HEIMDALL_NO_AUTOINIT=1.

Impact

Future agent sessions inherit package-imposed retrieval rules and MCP command registrations.

Mechanism

The postinstall hook detects agent directories, invokes quiet setup, and reaches adapters that write user-wide configuration and instructions.

Policy narrative

The automatic install hook discovers existing AI-agent installations and silently invokes their configuration writers. For Codex, this registers a package MCP server and appends mandatory retrieval instructions to the user's AGENTS.md. These changes affect subsequent agent behavior outside the package's own configuration. An opt-out environment variable does not establish affirmative consent for this default install-time mutation.

AI rationale

Inspected source proves unconsented postinstall mutation of foreign, user-wide AI-agent control surfaces. This meets the blocking policy regardless of source-similarity scanner labels.

Evidence

package.jsonbin/postinstall.mjsbin/heimdall.jsbin/lib/cli-main.mjsbin/lib/adapters.mjsbin/lib/enforcement-rules.mjs.codex/config.tomlAGENTS.md.pi/agent/AGENTS.md

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

66if (!hasGraft) { L67: results.push({ repo, status: "skipped", detail: "graft unavailable — npm i -g @nanonets/graft" }); L68: continue; ... L70: try { L71: const r = spawnSync("graft", ["build"], { cwd: repo, stdio: "ignore", timeout: 120_000 }); L72: if (r.status !== 0 || r.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/index-bootstrap.mjsView on unpkg · L66

bin/lib/setup.mjsView file

7Trigger-reachable persistence chain: scripts.postinstall -> bin/postinstall.mjs -> bin/lib/setup.mjs L7: // runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/lib/setup.mjsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/lib/setup.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lib/setup.mjsView on unpkg

7// runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. return join(pkgroot(), "bin", "heimdall.js"); } function writepi(home) { const npmroots = [join(home, ".pi", "agent", "npm", "node_modules"), join(home, ".pi", "npm", "node_modules")]; for (con

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/lib/graft-build.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lib/graft-build.mjs#virtual:normalized:round1View on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 49-77json

49 "docs/assets/",

50 "README.md",

51 "LICENSE",

52 "vendor/graft/",

53 "!vendor/graft/build/",

54 "!vendor/graft/third_party/llama.cpp/",

55 "!vendor/graft/models/",

56 "!vendor/graft/**/*.db",

57 "!vendor/graft/**/*.db-shm",

58 "!vendor/graft/**/*.db-wal",

59 "vendor/graphify/",

60 "!vendor/graphify/**/__pycache__/"

61 ],

62 "engines": {

63 "node": ">=22.5"

64 },

65 "type": "module",

66 "scripts": {

67 "test": "node --test \"tests/**/*.test.mjs\"",

68 "typecheck": "tsc --noEmit",

69 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L69

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L69

70 },

71 "devDependencies": {

72 "@types/node": "^22.0.0",

73 "typebox": "^1.3.0",

74 "typescript": "^5.6.0"

75 }

76}

77

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/setup.mjsView file

Lines 1-27javascript

1// setup.mjs — `heimdall setup`: hardware-aware config generation + daemon install.

2//

3// Detects the machine (accelerator, cores), renders an annotated

4// ~/.graft/config.yaml for the graft C++ daemon, optionally downloads an

5// embedding model, and installs/repairs the launchd daemon. Pure helpers

6// (detectHardware, renderConfig, parseSetupArgs) are exported for tests;

7// runSetup() is the CLI entry.

8import { execFileSync } from "node:child_process";

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. return join(pkgroot(), "bin", "heimdall.js"); } function writepi(home) { const npmroots = [join(home, ".pi", "agent", "npm", "node_modules"), join(home, ".pi", "npm", "node_modules")]; for (con

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/lib/graft-build.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lib/graft-build.mjs#virtual:normalized:round1View on unpkg

bin/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg