registry / @hmharness/cli / 0.21.0
@hmharness/cli@0.21.0
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe default TUI behavior silently initiates a global self-update, creating a supply-chain update risk that merits a warning. The package-scoped registry destination and user-started trigger do not establish malicious intent or justify blocking.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user starts the TUI while a newer registry version is available and auto-update is not disabled in configuration.
Impact
The global CLI installation is replaced with the newer package release, which will run on later invocations.
Mechanism
The TUI checks the package registry and launches a detached global npm install for the newer @hmharness/cli release.
AI rationale
The default TUI behavior silently initiates a global self-update, creating a supply-chain update risk that merits a warning. The package-scoped registry destination and user-started trigger do not establish malicious intent or justify blocking.
Evidence
dist/tui.jsdist/update-check.jspackage.jsondist/main.js
Network endpoints2
registry.npmjs.org/-/package/@hmharness/cli/dist-tagsregistry.npmjs.org/
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The TUI starts automatic update logic by default when run; setting `tui.autoUpdate` to false changes it to a notice only.
- The updater installs a newer `@hmharness/cli` release globally from registry.npmjs.org in a detached process.
- The manifest defines no install lifecycle hooks; its only script is `build`.
Evidence against
- The update check targets this package’s own npm registry entry, and the install command is limited to the CLI package.
- The updater is reached through the user-started TUI, not through package installation or import alone.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/main.jsView file
33package = @hmharness/cli; repositoryIdentity = hmharness; dependency = @hmharness/agent
L33: import { harmonyTools } from '@hmharness/domain-harmony';
L34: import { baseTools, buildRegistry, buildSystemPrompt, runAgentTask, strings } from '@hmharness/agent';
L35: const DIM = (s) => `\x1b[2m${s}\x1b[0m`;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33dist/tui.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @hmharness/cli@0.15.0
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.15.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/tui.jsView on unpkg1707// auto-link: bring the web UI up in the background (hmh tui --no-web skips)
const webUp = noWeb ? false : await ensureWebDaemon(DEFAULT_WEB_PORT);
const rt = new TuiRuntime();
Findings
2 High6 Medium4 Low
HighCopied Package Dependency Bridgedist/main.js
HighPrevious Version Dangerous Deltadist/tui.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencedist/tui.js
MediumAi Review Evidencedist/tui.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.21.0.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.21.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.