registry / @highflame/overwatch / 2.0.12
@highflame/overwatch@2.0.12
IDE-agnostic security daemon for AI coding assistants. Evaluates prompts, tool calls, file operations, shell commands, and MCP usage in real time for Cursor, Claude Code, GitHub Copilot, Gemini CLI, and OpenAI Codex.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package has a meaningful, user-invoked cross-agent hook and telemetry surface, so it warrants a warning. Source inspection found no unconsented install-time mutation or concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `overwatch start` or `overwatch install <ide>`.
Impact
Prompts, tool, file, shell, and MCP event data may be monitored and policy-controlled after user activation.
Mechanism
AI-agent hook installation and remote policy evaluation.
AI rationale
The package has a meaningful, user-invoked cross-agent hook and telemetry surface, so it warrants a warning. Source inspection found no unconsented install-time mutation or concrete malicious chain.
Evidence
package.jsondist/cli.jsdist/daemon.jsdist/hooks/universal-hook.sh~/.overwatch/hooks/universal-hook.sh~/.cursor/hooks.json~/.claude/settings.json~/.gemini/settings.json~/.codex/hooks.json
Network endpoints2
api.highflame.ai/v1/cerberus/hooks/evaluate127.0.0.1:17580
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `overwatch start` detects installed AI agents and automatically invokes hook installation.
- Hook installation writes package-managed commands into assistant hook configuration.
- Hook events are forwarded to Highflame Cerberus for remote evaluation.
Evidence against
- package.json has no preinstall, install, or postinstall hook; only prepublishOnly builds.
- The control-surface changes follow an explicit `overwatch start` or `overwatch install` command.
- No hidden install-time execution, remote code loading, credential harvesting, or destructive payload was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
633try {
L634: const { execSync: execSync2 } = require("child_process");
L635: const findCmd = isWindows ? `where ${genericBinaryName}` : `which ${genericBinaryName}`;
High
•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior.
dist/index.js:
HIGHFLAME_API_URL = "https://control.highflame.ai";
HIGHFLAME_OAUTH_URL = "https://studio.highflame.ai";
HIGHFLAME_CERBERUS_URL = "https://api.highflame.ai/v1/cerberus";
fs2.writeFileSync(SESSION_PATH, data, { mode: SESSION_FILE_MODE });
fs18.writeFileSync(PID_FILE_PATH, String(pid));
fs18.writeFileSync(PORT_FILE_PATH, String(port));
fs18.writeFileSync(LEGACY_PORT_FILE_PATH, String(port));
NODE_PATH: path19.join(pkgDir, "node_modules")
High
Entrypoint Foreign Package Code Overwrite
Manifest-reachable source overwrites another installed package with package-defined remote behavior.
dist/index.jsView on unpkg43Cross-file remote execution chain: dist/index.js spawns dist/cli.js; helper contains network access plus dynamic code execution.
L43: os = __toESM(require("os"));
L44: LOG_FILE = path.join(os.homedir(), ".overwatch", "overwatch.log");
L45: Logger = class {
...
L153: // src/auth/pkce.ts
L154: function base64URLEncode(buffer) {
L155: return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
...
L181: VERSION = true ? "v2.0.12" : "0.0.0-dev";
L182: HIGHFLAME_API_URL = "https://control.highflame.ai";
L183: HIGHFLAME_OAUTH_URL = "https://studio.highflame.ai";
...
L356: const config = loadConfig();
L357: return config?.highflame?.baseUrl || process.env.HIGHFLAME_BASE_URL || HIGHFLAME_API_URL;
L358: }
Findings
2 Critical6 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalPrevious Version Dangerous Deltadist/daemon.js
HighChild Processdist/index.js
HighShelldist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/index.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/hooks/universal-hook.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @highflame/overwatch@2.0.12.
See all versions of @highflame/overwatch for other recorded verdicts.
- Review the evidence and your use of @highflame/overwatch@2.0.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.