registry / @highflame/overwatch / 2.0.14
@highflame/overwatch@2.0.14
IDE-agnostic security daemon for AI coding assistants. Evaluates prompts, tool calls, file operations, shell commands, and MCP usage in real time for Cursor, Claude Code, GitHub Copilot, Gemini CLI, OpenAI Codex, and Kiro.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry install lifecycle hook, so the source does not establish unconsented install-time malware. Its user-invoked automatic hook installation and remote forwarding of rich AI-agent payloads remain a meaningful extension-lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run overwatch start, then use a monitored AI agent after its hook is installed.
Impact
Prompts, tool-call details, and other agent event payloads may leave the machine; the package also changes multiple agent control surfaces.
Mechanism
Automatic agent-hook installation and remote forwarding of hook payloads.
AI rationale
The package has no registry install lifecycle hook, so the source does not establish unconsented install-time malware. Its user-invoked automatic hook installation and remote forwarding of rich AI-agent payloads remain a meaningful extension-lifecycle risk.
Evidence
dist/cli.jsdist/hooks/universal-hook.shdist/daemon.js~/.overwatch/hooks/universal-hook.sh~/.overwatch/config.json~/.cursor/hooks.json~/.claude/settings.json~/.gemini/settings.json~/.codex/hooks.json
Network endpoints3
api.highflame.aicontrol.highflame.aistudio.highflame.ai
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Running the start command detects installed AI agents and automatically installs hooks for several of them.
- Installed hooks forward agent event payloads to a local daemon, which builds remote requests containing the full payload.
- The daemon is configured to use a Highflame remote service and can silently self-apply updates for writable global installs.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The high-risk behavior is reached through user-run CLI commands rather than package installation or import.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
801try {
L802: const { execSync: execSync2 } = require("child_process");
L803: const findCmd = isWindows ? `where ${genericBinaryName}` : `which ${genericBinaryName}`;
High
dist/cli.jsView file
41Source sends the broad process environment to a literal external destination.
L41: * Constructs the CommanderError class
L42: * @param {number} exitCode suggested exit code which could be used with process.exit
L43: * @param {string} code an id string representing the error
...
L120: /**
L121: * @api private
L122: */
...
L939: var EventEmitter = require("events").EventEmitter;
L940: var childProcess4 = require("child_process");
L941: var path19 = require("path");
...
L988: this._outputConfiguration = {
L989: writeOut: (str) => process9.stdout.write(str),
L990: writeErr: (str) => process9.stderr.write(str),
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L41Findings
2 Critical6 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalPrevious Version Dangerous Deltadist/daemon.js
HighChild Processdist/index.js
HighShelldist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/daemon.js
HighSemantic Analysis Limitedlib/platform-loader.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/hooks/universal-hook.sh
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to @highflame/overwatch@2.0.14.
See all versions of @highflame/overwatch for other recorded verdicts.
- Review the evidence and your use of @highflame/overwatch@2.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.