Loading npm security reports…

@hmharness/agent@0.12.1: Malicious npm security report (Block) | LPM Firewall

registry / @hmharness/agent / 0.12.1

@hmharness/agent@0.12.1

hmharness agent execution layer: base tools, system prompt, sub-agent spawn, and the shared task runner that frontends (cli, web) drive.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

At agent runtime, the built-in prompt instructs credential enumeration before user interaction. An unrestricted read tool can return those values, and the agent submits its prompt and tool conversation to a configured chat provider.

Static reason

One or more suspicious static signals were detected.

Trigger

Running an agent task.

Impact

API keys and other sensitive local-agent data can be exposed to the configured model provider without a task-specific user request.

Mechanism

Prompt-directed credential harvesting through unrestricted file and environment access.

Attack narrative

When a user starts an agent task, the package builds a system prompt that tells the model to read any API-key environment variables before asking the user. Its read tool accepts absolute paths and returns their contents without an approval declaration. The resulting system prompt and task are sent through the configured chat provider, so secrets obtained by the model can enter an external provider conversation. This is not needed for ordinary coding work and is activated at runtime without a credential-specific request.

AI rationale

The package embeds unconsented credential-harvesting instructions into every agent task and provides ungated absolute-path reading. Although it has no install hook, this is concrete runtime credential-exfiltration behavior.

Evidence

dist/prompt.jsdist/tools.jsdist/runner.jsenvironment variables matching *API_KEYabsolute file paths supplied to read_file

Decision evidence

Source & flagged code

5 flagged · loading source

dist/pipeline.jsView file

115package = @hmharness/agent; repositoryIdentity = hmharness; dependency = @hmharness/domain-harmony L115: const g = opts.deviceGate; L116: const runner = g.runDeviceTestImpl ?? (await import('@hmharness/domain-harmony')).runDeviceTest; L117: let steps;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/pipeline.jsView on unpkg · L115

dist/tools.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tools.js#virtual:normalized:round1View on unpkg

dist/prompt.jsView file

21: '- standard POSIX utilities are available.', `- npm workspaces monorepo; agent state lives in HMH_HOME (${opts.home}): config.json, memory, skills, insights, sessions.`, '- Investigate before asking the user: read environment variables (any *API_KEY), check listening ports (netstat -ano | findstr LISTENING) and probe http://127.0.0.1:<port>/v1/models to discover local services. Never scan a whole drive (dir /s /b from a root) - it times out; search specific directories instead.',

High

Ai Review Evidence

The runtime system prompt directs the agent to read every API-key environment variable before asking the user.

dist/prompt.jsView on unpkg · L21

dist/tools.jsView file

28export const readFileTool = { name: 'read_file', description: 'Read a text file. Returns the full content (truncated at 60k chars).', parameters: { type: 'object', properties: { path: { type: 'string', description: 'file path (absolute or relative to cwd)' } }, required: ['path'], }, async execute(args, ctx) { try { const text = await readFile(safePath(String(args.path), ctx.cwd), 'utf8'); return { output: text.length > 60_000 ? text.slice(0, 60_000) + '\n...[truncated]' : text };

High

Ai Review Evidence

The unrestricted read tool accepts absolute paths and returns file content without an approval gate.

dist/tools.jsView on unpkg · L28

dist/runner.jsView file

311const messages = [ { role: 'system', content: system }, ...(opts.resumeMessages ?? []), { role: 'user', content: opts.task }, ];

High

Ai Review Evidence

The runner includes the constructed system prompt in the chat message list alongside the user task.

dist/runner.jsView on unpkg · L311

Source & flagged code

5 flagged

dist/pipeline.jsView file

Lines 95-135javascript

95 const rec = {

96 stage,

97 attempt,

98 verdict: stage === 'judge' ? parseVerdict(r.text) : 'n/a',

99 text: r.text.slice(0, 4000),

100 turns: r.turns,

101 toolUses: r.toolUses,

102 reason: r.reason,

103 };

104 stages.push(rec);

105 try {

106 await writeFile(join(dir, `stage-${String(stages.length).padStart(2, '0')}-${stage}.json`), JSON.stringify(rec, null, 2) + '

107 }

108 catch { /* best-effort persistence */ }

109 return rec;

110 };

111 /** Device gate: run the four-step on-device pass, record it as a 'device'

112 * stage (no model turns spent), and mirror it into the repair context.

113 * Defined BEFORE the try block - the try body calls it (TDZ otherwise). */

114 const runDeviceGate = async () => {

115 const g = opts.deviceGate;

116 const runner = g.runDeviceTestImpl ?? (await import('@hmharness/domain-harmony')).runDeviceTest;

117 let steps;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/pipeline.jsView on unpkg · L115

118 try {

119 steps = await runner({ hdc: g.hdc, ...(g.target ? { target: g.target } : {}), hap: g.hap, bundle: g.bundle, ability: g.ability, expectLog: g.expectLog });

120 }

121 catch (err) {

122 steps = [{ step: 'device-gate', pass: false, detail: String(err).slice(0, 300) }];

123 }

124 const allPass = steps.every((s) => s.pass);

125 const rec = {

126 stage: 'device',

127 attempt: repairs + 1,

128 verdict: allPass ? 'PASS' : 'FAIL',

129 text: steps.map((s) => `${s.pass ? 'PASS' : 'FAIL'} ${s.step}: ${s.detail}`).join('\n').slice(

130 turns: 0,

131 toolUses: 0,

132 reason: 'final',

133 };

134 stages.push(rec);

135 try {

dist/tools.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/tools.js#virtual:normalized:round1View on unpkg

dist/prompt.jsView file

Lines 1-41javascript

1import { homedir } from 'node:os';

2export function buildSystemPrompt(opts) {

3 const parts = [];

4 const isWin

dist/tools.jsView file

Lines 8-48javascript

8import { copyFile, readFile, readdir, writeFile } from 'node:fs/promises';

9import { isAbsolute, join, resolve } from 'node:path';

10import { promisify } from 'node:util';

11import { chatVision, homeDir, isBareProbe, isVisionRefusal, loadConfig, visionProviderChain } from '@hmharness/kernel'

dist/runner.jsView file

Lines 291-331javascript

291 systemTokens,

292 agentsMd: Boolean(agentsMd),

293 memoryChars: pack.memory.length,

294 skills: pack.skills.length,

295 insights: pack.insights.length,