@hmharness/cli
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
This report shows the evidence for @hmharness/cli@0.23.50. 4 of 92 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe web-start path silently launches recurring evolution and fine-tuning that use the configured provider key and can create paid jobs. The thresholds and opt-out reduce frequency but do not provide consent for automatic model use, data upload, or spending.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running `hmh web start`; the daemon then runs its first cycle after 30 seconds and repeats every six hours by default.
Impact
Unexpected provider charges and automatic transfer of training examples to the configured fine-tuning backend. Label thresholds, cooldowns, and an opt-out limit this behavior but do not make it user-requested.
Mechanism
The background process runs `evolve`, then calls `auto-finetune --submit`. When its gates pass, the CLI uploads labeled training data using the configured provider key and creates a paid fine-tuning job.
Attack narrative
Starting the web server silently enables a recurring background agent that uses the configured provider account for model calls and, when its gates pass, uploads labeled training data and submits a paid fine-tuning job without a separate user request.
AI rationale
The web-start path silently launches recurring evolution and fine-tuning that use the configured provider key and can create paid jobs. The thresholds and opt-out reduce frequency but do not provide consent for automatic model use, data upload, or spending.
Evidence
dist/main.jsdist/evolution-daemon.js<HMH_HOME>/evolution-daemon-runner.cjs<HMH_HOME>/evolution-daemon.pid<HMH_HOME>/evolution-daemon.log
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Starting `hmh web` silently starts the evolution daemon; the source says the user does not trigger `hmh evolve` manually.
- The daemon runs `evolve` after startup and on a six-hour schedule; its source describes 40+ model calls per cycle.
- After each evolution cycle, the daemon invokes `auto-finetune --submit`, which uses the configured provider key to upload training data and create a paid fine-tuning job.
- Fine-tuning is gated on at least 50 labels, a cooldown, no active job, and can be disabled with `finetune.auto=false`.
- The package manifest defines only a build script and no install lifecycle hooks.
Evidence against
- The fine-tuning backend is resolved from the user's configured chat provider and its base URL.
- Automatic fine-tuning has label, cooldown, active-job, and opt-out gates.
- The package has no install, preinstall, or postinstall script.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
18 flaggedboard/install-kaihongos.cjsView file
38const https = require('https');
L39: const { spawnSync } = require('child_process');
L40: // board config defaults live in a shared module that ships in
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L38•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = board/install-kaihongos.cjs
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
board/install-kaihongos.cjsView on unpkgdist/web-daemon.jsView file
79try {
L80: const out = execSync(`powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}').CommandLine"`, { encoding: 'utf8', timeout: 8000 });
L81: const cmd = out.trim();
Findings
16 High5 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/heal-tree.cjs
HighCopied Package Dependency Bridgedist/main.js
HighTrigger Reachable Persistencedist/extension-daemon.js
HighSemantic Analysis Limiteddist/extension-daemon.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/web-daemon.js
HighKnown Malware Source Similaritydist/extension-daemon.js
HighKnown Malware Source Similaritydist/tui.js
HighKnown Malware Source Similarityboard/heal-tree.cjs
HighKnown Malware Source Similarityboard/install-kaihongos.cjs
Affected versions and remediation
This report applies to @hmharness/cli@0.23.50.
The versions list below shows the verdict for each recorded version.
- Avoid installing @hmharness/cli@0.23.50. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.