@hmharness/cli@0.19.5
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe TUI performs a default background self-update from the package’s registry, creating a concrete remote code execution capability through installation of a newer release. The inspected behavior is package-aligned and user-triggered at TUI launch, so this warrants a warning rather than a malware block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs `hmh tui` while automatic updates are enabled and a newer release is available.
Impact
A newer package release can execute as part of the global installation; inspected code does not establish a malicious payload or unrelated recipient.
Mechanism
The updater checks the npm registry and launches a detached global npm install for the reported latest version.
AI rationale
The TUI performs a default background self-update from the package’s registry, creating a concrete remote code execution capability through installation of a newer release. The inspected behavior is package-aligned and user-triggered at TUI launch, so this warrants a warning rather than a malware block.
Evidence
dist/tui.jsdist/update-check.jspackage.jsondist/main.js
Network endpoints1
registry.npmjs.org/-/package/@hmharness/cli/dist-tags
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest defines only a build script and lists sibling packages as dependencies; it has no install lifecycle hook or runtime dependency on itself.
- Running the TUI starts its update logic by default, with an opt-out configuration setting.
- The updater checks the npm registry for the latest version and launches a detached global npm install for that version.
Evidence against
- The update check targets the package’s own registry dist-tag and the updater installs the same CLI package.
- The updater is reached through the explicit `hmh tui` command; no foreign agent configuration mutation is shown in the inspected paths.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/main.jsView file
33package = @hmharness/cli; repositoryIdentity = hmharness; dependency = @hmharness/agent
L33: import { harmonyTools } from '@hmharness/domain-harmony';
L34: import { baseTools, buildRegistry, buildSystemPrompt, runAgentTask, strings } from '@hmharness/agent';
L35: const DIM = (s) => `\x1b[2m${s}\x1b[0m`;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33907if (cmd === 'tui') {
await initHome();
// tui(yes, noWeb): inside the TTY check the TUI auto-links the web UI
const { tui } = await import("./tui.js");
await tui(yes, rest.in
Medium
Ai Review Evidence
Running the TUI starts its update logic by default, with an opt-out configuration setting.
dist/main.jsView on unpkg · L907dist/tui.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @hmharness/cli@0.15.0
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.15.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Findings
2 High6 Medium4 Low
HighCopied Package Dependency Bridgedist/main.js
HighPrevious Version Dangerous Deltadist/tui.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/main.js
MediumAi Review Evidencedist/tui.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.19.5.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.19.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.