registry / @arihantdeva/heimdall / 0.2.1

@arihantdeva/heimdall@0.2.1

Verified, self-healing knowledge layer for AI coding agents (orchestration over Graft-style semantic memory backends)

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Agent configuration writes are real, but the inspected caller exposes them through the explicit `heimdall init` command and the package has no install lifecycle hook. This is user-invoked setup, so no malicious behavior was established.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user invokes `heimdall init`, optionally selecting a harness.

Impact

This changes later agent instructions or hooks after explicit setup; the inspected source does not establish an unconsented install-time change.

Mechanism

The command writes adapter guidance into agent configuration; for Claude Code it can also add a post-tool command hook.

AI rationale

Evidence

bin/lib/adapters.mjsbin/lib/cli-main.mjs

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines a CLI and has no preinstall, install, or postinstall hook.
The explicit `init` command invokes the adapter; the CLI dispatch reaches it only for `init`.
The Codex adapter appends Heimdall search instructions to the user's `AGENTS.md` when they are absent.
The Claude Code adapter adds a post-tool hook to the user's settings file.

Evidence against

No automatic lifecycle trigger for agent configuration writes was found.
The inspected agent configuration changes are reached through explicit CLI setup.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 87.3 KB of source, external domains: github.com

Source & flagged code

6 flagged

bin/lib/adapters.mjsView file

Lines 38-89javascript

38 try { settings = JSON.parse(readFileSync(settingsPath, "utf8")); } catch { /* start fresh */ }

39 }

40 settings.hooks = settings.hooks || {};

41 settings.hooks.PostToolUse = settings.hooks.PostToolUse || [];

42 // The hook is a hint emitter, nothing more: it appends one line and exits.

43 // It must never write the graph — only the reconciler holds the lock — and it

44 // must never be slow enough to be felt, since it runs after every edit.

45 // Resolve the CLI ONCE at init (npm root -g is slow and can differ inside

46 // hook shells); fall back to a PATH shim if the package moves.

47 let cli = "";

48 try {

49 const root = execFileSync("npm", ["root", "-g"], { encoding: "utf8" }).trim();

50 // Scoped install (@arihantdeva/heimdall) nests one level deeper than unscoped.

51 for (const candidate of [join(root, "@arihantdeva", "heimdall", "bin", "heimdall.js"), join(root, "heimdall", "bin", "heimdall.js")]) {

52 if (existsSync(candidate)) { cli = candidate; break; }

53 }

54 } catch { /* npm missing -> leave empty, fall through to shim */ }

55 const hookCmd = cli

56 ? `node '${cli}' hint --stdin 2>/dev/null || true`

57 : "heimdall hint --stdin 2>/dev/null || true";

58 if (!settings.hooks.PostToolUse.some((h) => JSON.stringify(h).includes("heimdall"))) {

59 settings.hooks.PostToolUse.push({

60 matcher: "Write|Edit",

61 hooks: [{ type: "command", command: hookCmd }],

62 });

63 }

64 writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");

Low

Ai Review Evidence

The Claude Code adapter adds a post-tool hook to the user's settings file.

bin/lib/adapters.mjsView on unpkg · L58

65 writeFileSync(join(home, ".claude", "HEIMDALL.md"), SEARCH_SNIPPET);

66 return "claude-code";

67}

69function writeCodex(home) {

70 const mdPath = join(home, "AGENTS.md");

71 let md = existsSync(mdPath) ? readFileSync(mdPath, "utf8") : "";

72 if (!md.includes("heimdall search")) {

73 md += (md ? "\n" : "") + SEARCH_SNIPPET + "\n";

74 writeFileSync(mdPath, md);

Low

Ai Review Evidence

The Codex adapter appends Heimdall search instructions to the user's `AGENTS.md` when they are absent.

bin/lib/adapters.mjsView on unpkg · L69

75 }

76 return "codex";

77}

79function writeRules(home, dirName, fileName) {

80 const rulesDir = ensure(join(home, dirName, "rules"));

81 const rulesPath = join(rulesDir, fileName);

82 if (!existsSync(rulesPath)) writeFileSync(rulesPath, SEARCH_SNIPPET + "\n");

83 return fileName;

84}

86const WRITERS = {

87 pi: writePi,

88 "claude-code": writeClaudeCode,

89 codex: writeCodex,

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. mkdirsync(dir, { recursive: true }); return dir; } function writepi(home) { const cfgdir = ensure(join(home, ".heimdall", "adapters", "pi")); writefilesync( join(cfgdir, "readme.md"), "# pi adapter\n\ncopy extensions/kb-*.ts from the heimdall package into your pi extensions dir:\n cp <npm-root>/@[redacted]-*.ts ~/.pi/agent/extensions/\nthen add kb_search/kb_insert/kb_sync tools (kb-tools.ts) — they call the vendored bin/ scripts.\n", ); writefilesync(join(cfgdir, "snippet.md"), search_snippet); return "pi"; } function writeclaudecode(home) { const settingsdir = ensure(join(home, ".claude")); const settingspath = join(settingsdir, "settings.json"); le

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/lib/cli-main.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.704 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/cli-main.mjsView on unpkg

package.jsonView file

Lines 2-33json

2 "name": "@arihantdeva/heimdall",

3 "version": "0.2.1",

4 "description": "Verified, self-healing knowledge layer for AI coding agents (orchestration over Graft-style semantic memory backends)",

5 "license": "MIT",

6 "bin"

Source & flagged code

6 flagged · loading source

bin/lib/adapters.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

69function writeCodex(home) { const mdPath = join(home, "AGENTS.md"); let md = existsSync(mdPath) ? readFileSync(mdPath, "utf8") : ""; if (!md.includes("heimdall search")) { md += (md ? "\n" : "") + SEARCH_SNIPPET + "\n"; writeFileSync(mdPath, md);

Low

Ai Review Evidence

The Codex adapter appends Heimdall search instructions to the user's `AGENTS.md` when they are absent.

bin/lib/adapters.mjsView on unpkg · L69

Findings

2 High3 Medium7 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/lib/adapters.mjs

HighPrevious Version Dangerous Deltabin/lib/cli-main.mjs

MediumEnvironment Vars

MediumShips Build Helperbin/seed-graft.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencebin/lib/adapters.mjs

Affected versions and remediation

This report applies to @arihantdeva/heimdall@0.2.1.

See all versions of @arihantdeva/heimdall for other recorded verdicts.

Review the evidence and your use of @arihantdeva/heimdall@0.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 11:35:34.043Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.