registry / @h1veframework/cli / 0.13.0

@h1veframework/cli@0.13.0

The CLI for H1VE — the governance & memory layer for teams building with AI. Drive your feature flow (start, status, move, spec, done) from the terminal. Works with Claude Code, Cursor and Copilot.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `h1ve mcp install`, `h1ve connect`, or `h1ve serve` and performs a paired request.

Impact

Can register a first-party MCP launcher in Claude Code and modify selected local or cloud environment variables using supplied credentials.

Mechanism

Explicit user-command agent configuration and credential deployment integration.

Rationale

Source inspection finds an explicit user-command AI-agent configuration mutation and deployment credential capability, not automatic malware. Downgrade to warn for the declared capability risk rather than block publication.

Evidence

package.jsondist/index.jsREADME.md.env.local~/.config/h1ve/credentials.json

Network endpoints6

app.h1ve.orgapi.vercel.comapi.netlify.comapi.fly.io/graphqlbackboard.railway.com/graphql/v2api.render.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` implements explicit `h1ve mcp install`, installing `@h1veframework/mcp` globally and invoking `claude mcp remove/add`.
`dist/index.js` starts a loopback agent that can write gitignored `.env.local` values and apply/remove deployment-provider environment variables after pairing-token checks.
The local agent forwards user-supplied deployment tokens and environment values to Vercel, Netlify, Fly, Railway, or Render APIs.

Evidence against

`package.json` has only `prepublishOnly`; there are no install-time lifecycle hooks.
`dist/index.js` runs its main routine only through the declared CLI bin, not on dependency import.
Agent endpoints bind to `127.0.0.1`, enforce configured origin/loopback host and pairing-token validation.
Env writes require a user command or paired local-agent request and refuse files not gitignored.
No credential harvesting, arbitrary remote payload loading, hidden persistence, or unrelated exfiltration was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 1 file(s), 62.8 KB of source, external domains: 127.0.0.1, api.fly.io, api.netlify.com, api.render.com, api.vercel.com, app.h1ve.org, backboard.railway.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { parseArgs } from "util";

5import { readFile } from "fs/promises";

6import { existsSync } from "fs";

7import { exec } from "child_process";

8

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9// ../core/src/branch.ts

10import { execFile } from "child_process";

11import { promisify } from "util";

12var execFileAsync = promisify(execFile);

13var defaultGitRunner = async (args) => {

14 const { stdout } = await execFileAsync("git", args, { cwd: process.cwd() });

15 return stdout;

16};

17async function currentBranch(runner = defaultGitRunner) {

18 let out;

19 try {

20 out = await runner(["rev-parse", "--abbrev-ref", "HEAD"]);

21 } catch {

22 throw new Error("NOT_A_GIT_BRANCH");

23 }

24 const branch = out.trim();

25 if (!branch || branch === "HEAD") throw new Error("NOT_A_GIT_BRANCH");

26 return branch;

Lines 1281-1321javascript

1281 {

1282 method: req.method ?? "GET",

1283 path: (req.url ?? "/").split("?")[0] ?? "/",

1284 origin: req.headers.origin

Source & flagged code

2 flagged · loading source

dist/index.jsView file

6import { existsSync } from "fs"; L7: import { exec } from "child_process"; L8:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

1301}); L1302: process.stdout.write( L1303: `Agente H1VE ouvindo em http://127.0.0.1:${port} L1304: Origem permitida: ${origin} ... L1316: import { randomBytes as randomBytes2 } from "crypto"; L1317: import { execFile as execFile2 } from "child_process"; L1318: var LOGIN_TIMEOUT_MS = 3 * 60 * 1e3;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1301

Findings

3 High3 Medium5 Low

HighChild Processdist/index.js

HighShell

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2

3// src/index.ts

4import { parseArgs } from "util";

5import { readFile } from "fs/promises";

6import { existsSync } from "fs";

7import { exec } from "child_process";

8

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L6

9// ../core/src/branch.ts

10import { execFile } from "child_process";

11import { promisify } from "util";

12var execFileAsync = promisify(execFile);

13var defaultGitRunner = async (args) => {

14 const { stdout } = await execFileAsync("git", args, { cwd: process.cwd() });

15 return stdout;

16};

17async function currentBranch(runner = defaultGitRunner) {

18 let out;

19 try {

20 out = await runner(["rev-parse", "--abbrev-ref", "HEAD"]);

21 } catch {

22 throw new Error("NOT_A_GIT_BRANCH");

23 }

24 const branch = out.trim();

25 if (!branch || branch === "HEAD") throw new Error("NOT_A_GIT_BRANCH");

26 return branch;

Lines 1281-1321javascript

1281 {

1282 method: req.method ?? "GET",

1283 path: (req.url ?? "/").split("?")[0] ?? "/",

1284 origin: req.headers.origin

??

null

,

1285 host: req.headers.host ?? null,

1286 token: req.headers["x-pairing-token"] ?? null,

1287 body

1288 },

1289 deps

1290 );

1291 res.writeHead(result.status, corsHeaders(origin));

1292 res.end(result.body === null ? "" : JSON.stringify(result.body));

1293 })().catch(() => {

1294 res.writeHead(500, corsHeaders(origin));

1295 res.end("{}");

1296 });

1297 });

1298 await new Promise((resolve, reject) => {

1299 server.on("error", reject);

1300 server.listen(port, "127.0.0.1", resolve);

1301 });

1302 process.stdout.write(

1303 `Agente H1VE ouvindo em http://127.0.0.1:${port}

1304Origem permitida: ${origin}

1305C\xF3digo de pareamento: ${pairingToken}

1306Cole o c\xF3digo no painel /connections. Ctrl+C para parar.

1307`

1308 );

1309 await new Promise(() => {

1310 });

1311 return { human: "", data: null };

1312}

1313

1314// src/commands/login.ts

1315import { createServer as createServer2 } from "http";

1316import { randomBytes as randomBytes2 } from "crypto";

1317import { execFile as execFile2 } from "child_process";

1318var LOGIN_TIMEOUT_MS = 3 * 60 * 1e3;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1301

1319function buildAuthorizeUrl(baseUrl, port, state) {

1320 const base = baseUrl.replace(/\/+$/, "");

1321 return `${base}/cli-login?port=${port}&state=${encodeURIComponent(state)}`;