@arihantdeva/heimdall@0.4.0: Clean npm security report (Allow)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 87.7 KB of source

Source & flagged code

2 flagged

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. mkdirsync(dir, { recursive: true }); return dir; } function writepi(home) { const cfgdir = ensure(join(home, ".heimdall", "adapters", "pi")); writefilesync( join(cfgdir, "readme.md"), "# pi adapter\n\ncopy extensions/kb-*.ts from the heimdall package into your pi extensions dir:\n cp <npm-root>/@[redacted]-*.ts ~/.pi/agent/extensions/\nthen add kb_search/kb_insert/kb_sync tools (kb-tools.ts) — they call the vendored bin/ scripts.\n", ); writefilesync(join(cfgdir, "snippet.md"), search_snippet); return "pi"; } function writeclaudecode(home) { const settingsdir = ensure(join(home, ".claude")); const settingspath = join(settingsdir, "settings.json"); le

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

Source & flagged code

2 flagged · loading source

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. mkdirsync(dir, { recursive: true }); return dir; } function writepi(home) { const cfgdir = ensure(join(home, ".heimdall", "adapters", "pi")); writefilesync( join(cfgdir, "readme.md"), "# pi adapter\n\ncopy extensions/kb-*.ts from the heimdall package into your pi extensions dir:\n cp <npm-root>/@[redacted]-*.ts ~/.pi/agent/extensions/\nthen add kb_search/kb_insert/kb_sync tools (kb-tools.ts) — they call the vendored bin/ scripts.\n", ); writefilesync(join(cfgdir, "snippet.md"), search_snippet); return "pi"; } function writeclaudecode(home) { const settingsdir = ensure(join(home, ".claude")); const settingspath = join(settingsdir, "settings.json"); le

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code