Loading npm security reports…

@arihantdeva/heimdall@0.7.0: AI-agent control-surface risk | LPM Firewall

registry / @arihantdeva/heimdall / 0.7.0

@arihantdeva/heimdall@0.7.0

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

AI Security Review

scanned 7h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies detected third-party AI-agent control surfaces. It installs persistent MCP registrations, hooks, plugins, and instruction files, then backgrounds a home-directory repository indexer.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

AI harnesses can execute the package CLI and receive package-authored behavioral instructions without an explicit setup command.

Mechanism

automatic foreign AI-agent configuration and hook installation

Policy narrative

On npm installation, postinstall detects AI coding-agent configuration directories and invokes harness setup without user confirmation. The setup writes MCP registrations, tool hooks, plugins, and rule/instruction files into multiple external agent control surfaces; it also starts detached background indexing of repositories under the user home directory. This is unconsented install-time mutation of broad foreign AI-agent control surfaces.

Rationale

The package’s install hook directly performs configuration and hook injection into detected third-party agent environments, rather than requiring an explicit user command. This meets the blocking policy despite no confirmed network exfiltration.

Evidence

package.jsonbin/postinstall.mjsbin/lib/adapters.mjsbin/lib/index-bootstrap.mjs~/.claude/settings.json~/.claude/CLAUDE.md~/.codex/config.toml~/AGENTS.md~/.cursor/mcp.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

66if (!hasGraft) { L67: results.push({ repo, status: "skipped", detail: "graft unavailable — npm i -g @nanonets/graft" }); L68: continue; ... L70: try { L71: const r = spawnSync("graft", ["build"], { cwd: repo, stdio: "ignore", timeout: 120_000 }); L72: if (r.status !== 0 || r.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/index-bootstrap.mjsView on unpkg · L66

bin/lib/extract.mjsView file

24".php": "php", ".swift": "swift", ".lua": "lua", ".zig": "zig", L25: ".ps1": "powershell", ".ex": "elixir", ".exs": "elixir", L26: ".m": "objc", ".mm": "objc", ".jl": "julia",

High

Shell

Package source references shell execution.

bin/lib/extract.mjsView on unpkg · L24

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.704 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 27-55json

27 "heimdall": "bin/heimdall.js"

28 },

29 "files": [

30 "bin/",

31 "!bin/__pycache__/",

32 "!bin/render-demo.py",

33 "extensions/",

34 "types/",

35 "config/",

36 "docs/adapters.md",

37 "README.md",

38 "LICENSE"

39 ],

40 "engines": {

41 "node": ">=22.5"

42 },

43 "type": "module",

44 "scripts": {

45 "test": "node --test \"tests/**/*.test.mjs\"",

46 "typecheck": "tsc --noEmit",

47 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 },

49 "devDependencies": {

50 "@types/node": "^22.0.0",

51 "typebox": "^1.3.0",

52 "typescript": "^5.6.0"

53 }

54}

55

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/extract.mjsView file

Lines 4-44javascript

4// produce the same node/edge set. That property is what makes reconcile

5// idempotent, and therefore what makes concurrent edits harmless.

6import { execFileSync } from "node:child_process";

7import { createHash } from "node:crypto";

8import { readFileSync, statSync } from "node:fs";

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

bin/postinstall.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.704 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.mjsView on unpkg