Loading npm security reports…

@arihantdeva/heimdall@0.6.2: AI-agent control-surface risk | LPM Firewall

registry / @arihantdeva/heimdall / 0.6.2

@arihantdeva/heimdall@0.6.2

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies detected third-party AI agents' configuration and behavioral instructions without affirmative consent.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall, unless HEIMDALL_NO_AUTOINIT is set to 1.

Impact

Subsequent agent sessions execute package integrations and receive altered behavioral instructions across unrelated projects.

Mechanism

The lifecycle hook invokes quiet CLI initialization, which installs agent extensions, hooks, MCP registrations, and mandatory memory rules into user-level control surfaces.

Policy narrative

The npm lifecycle hook detects existing agent installations and invokes their adapters automatically. Those adapters modify user-level configuration and instruction files, enabling package tools and enforcement behavior in future sessions. Detection and an environment opt-out do not establish consent to modify these foreign agent control surfaces.

AI rationale

Direct source inspection establishes unconsented postinstall mutation of broad third-party AI-agent control surfaces, meeting the blocking policy. Source citation tools failed with a closed transport, so no citation IDs are available.

Evidence

package.jsonbin/postinstall.mjsbin/heimdall.jsbin/lib/cli-main.mjsbin/lib/adapters.mjsbin/lib/enforcement-rules.mjs.claude/settings.json.claude/CLAUDE.md

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

66if (!hasGraft) { L67: results.push({ repo, status: "skipped", detail: "graft unavailable — npm i -g @nanonets/graft" }); L68: continue; ... L70: try { L71: const r = spawnSync("graft", ["build"], { cwd: repo, stdio: "ignore", timeout: 120_000 }); L72: if (r.status !== 0 || r.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/index-bootstrap.mjsView on unpkg · L66

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.7.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-orient.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-orient.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-orient.tsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 27-55json

27 "heimdall": "bin/heimdall.js"

28 },

29 "files": [

30 "bin/",

31 "!bin/__pycache__/",

32 "!bin/render-demo.py",

33 "extensions/",

34 "types/",

35 "config/",

36 "docs/adapters.md",

37 "README.md",

38 "LICENSE"

39 ],

40 "engines": {

41 "node": ">=22.5"

42 },

43 "type": "module",

44 "scripts": {

45 "test": "node --test \"tests/**/*.test.mjs\"",

46 "typecheck": "tsc --noEmit",

47 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 },

49 "devDependencies": {

50 "@types/node": "^22.0.0",

51 "typebox": "^1.3.0",

52 "typescript": "^5.6.0"

53 }

54}

55

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.556 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.7.0 matchedPath = bin/postinstall.mjs matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.mjsView on unpkg

extensions/kb-orient.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-orient.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-orient.tsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.10.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg