Loading npm security reports…

@arihantdeva/heimdall@0.9.0: Malicious npm security report | LPM Firewall

registry / @arihantdeva/heimdall / 0.9.0

@arihantdeva/heimdall@0.9.0

Verified, self-healing knowledge layer for AI coding agents: cross-repo memory with trust verdicts, zero-token CPU-only indexing, hybrid retrieval

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

On npm installation, the package detects AI-agent harnesses and alters their user-level control configurations. It also starts a detached process that inventories repositories in the home directory.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Installs persistent hooks, MCP commands, extensions, and agent instructions without an explicit setup command.

Mechanism

Automatic AI-agent configuration mutation and background home-directory indexing

Attack narrative

Installing the package runs postinstall. That script identifies existing agent harnesses and invokes adapter writers without asking the user. The adapters register a local MCP server, install hooks and extensions, and append agent instruction files in home-directory control surfaces. The same lifecycle script starts a detached indexer that walks home-directory repositories. The copied Pi extension then intercepts and transforms a user prompt using machine-wide search results.

AI rationale

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces plus background home-directory repository indexing. The lifecycle-triggered persistence chain meets the install-hook abuse blocking policy.

Evidence

package.jsonbin/postinstall.mjsbin/lib/adapters.mjsbin/lib/index-bootstrap.mjsextensions/kb-orient.ts~/.claude/settings.json~/.claude/CLAUDE.md~/.codex/config.toml

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/lib/index-bootstrap.mjsView file

5// degrades to a per-repo "skipped" line — indexing is best-effort by design. L6: import { execFileSync, spawnSync } from "node:child_process"; L7: import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/lib/index-bootstrap.mjsView on unpkg · L5

66if (!hasGraft) { L67: results.push({ repo, status: "skipped", detail: "graft unavailable — npm i -g @nanonets/graft" }); L68: continue; ... L70: try { L71: const r = spawnSync("graft", ["build"], { cwd: repo, stdio: "ignore", timeout: 120_000 }); L72: if (r.status !== 0 || r.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/index-bootstrap.mjsView on unpkg · L66

bin/lib/extract.mjsView file

24".php": "php", ".swift": "swift", ".lua": "lua", ".zig": "zig", L25: ".ps1": "powershell", ".ex": "elixir", ".exs": "elixir", L26: ".m": "objc", ".mm": "objc", ".jl": "julia",

High

Shell

Package source references shell execution.

bin/lib/extract.mjsView on unpkg · L24

bin/lib/setup.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @arihantdeva/heimdall@0.4.0 matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.4.0 similarity = 0.481 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/lib/setup.mjsView on unpkg

7Trigger-reachable persistence chain: scripts.postinstall -> bin/postinstall.mjs -> bin/lib/setup.mjs L7: // runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/lib/setup.mjsView on unpkg · L7

7// runSetup() is the CLI entry. L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: const ROOT = dirname(dirname(HERE)); // repo root L18: export const CATALOG = JSON.parse(readFileSync(join(HERE, "models-catalog.json"), "utf8")); L19: L20: export const graftConfigPath = () => join(os.homedir(), ".graft", "config.yaml"); L21: export const modelsDir = () => join(os.homedir(), ".graft", "models"); ... L28: } catch (e) { L29: return { ok: false, out: String(e.stdout || ""), err: String(e.stderr || e.message || "") }; L30: } ... L75: export function detectHardware() {

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

extensions/kb-orient.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.7.0 matchedPath = extensions/kb-orient.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-orient.tsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.7.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 34-62json

34 "types/",

35 "config/",

36 "docs/adapters.md",

37 "README.md",

38 "LICENSE",

39 "vendor/graft/",

40 "!vendor/graft/build/",

41 "!vendor/graft/third_party/llama.cpp/",

42 "!vendor/graft/models/",

43 "!vendor/graft/**/*.db",

44 "!vendor/graft/**/*.db-shm",

45 "!vendor/graft/**/*.db-wal"

46 ],

47 "engines": {

48 "node": ">=22.5"

49 },

50 "type": "module",

51 "scripts": {

52 "test": "node --test \"tests/**/*.test.mjs\"",

53 "typecheck": "tsc --noEmit",

54 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 },

56 "devDependencies": {

57 "@types/node": "^22.0.0",

58 "typebox": "^1.3.0",

59 "typescript": "^5.6.0"

60 }

61}

62

bin/lib/index-bootstrap.mjsView file

Lines 1-25javascript

1// index-bootstrap — `heimdall index`: one-command corpus bootstrap for a new

2// user. Discovers git repos under $HOME (depth-bounded), runs `graft build`

3// in each (per-repo code graph; skipped if graft CLI absent), then runs

4// embed-index.py build once for the global semantic index. Every failure

5// degrades to a per-repo "skipped" line — indexing is best-effort by design.

6import { execFileSync, spawnSync } from "node:child_process";

7import { existsSync, readdirSync, statSync } from

bin/lib/extract.mjsView file

Lines 4-44javascript

4// produce the same node/edge set. That property is what makes reconcile

5// idempotent, and therefore what makes concurrent edits harmless.

6import { execFileSync } from "node:child_process";

7import { createHash } from "node:crypto";

8import { readFileSync, statSync } from "node:fs";

bin/lib/setup.mjsView file

Lines 1-27javascript

1// setup.mjs — `heimdall setup`: hardware-aware config generation + daemon install.

2//

3// Detects the machine (accelerator, cores), renders an annotated

4// ~/.graft/config.yaml for the graft C++ daemon, optionally downloads an

5// embedding model, and installs/repairs the launchd daemon. Pure helpers

6// (detectHardware, renderConfig, parseSetupArgs) are exported for tests;

7// runSetup() is the CLI entry.

8import { execFileSync } from "node:child_process";

bin/lib/adapters.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. export function installhookbinary(home = home()) { const dest = ensure(join(home, ".local", "bin")); const src = join(pkgroot(), "bin", "heimdall-hook.mjs"); if (!existssync(src)) throw new error(`heimdall-hook.mjs not found at ${src}`); const target = join(dest, "heimdall-hook"); copyfilesync(src, target); chmodsync(target, 0o755); return target; } function mcpserverentry(nodebin, heimdalljs) { return { command: nodebin || "node", args: [heimdalljs], env: {} }; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/lib/adapters.mjsView on unpkg

bin/seed-graft.shView file

•path = bin/seed-graft.sh kind = build_helper sizeBytes = 1743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/seed-graft.shView on unpkg

extensions/kb-orient.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.7.0 matchedPath = extensions/kb-orient.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-orient.tsView on unpkg

extensions/kb-tools.tsView file

•matchType = normalized_sha256 matchedPackage = @arihantdeva/heimdall@0.7.0 matchedPath = extensions/kb-tools.ts matchedIdentity = npm:QGFyaWhhbnRkZXZhL2hlaW1kYWxs:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

extensions/kb-tools.tsView on unpkg