registry / @hmharness/cli / 0.21.2
@hmharness/cli@0.21.2
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe install-like subprocess is explicitly invoked for an ablation task, while the TUI updater is package-aligned and installs this CLI from its registry. The inspected source does not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the explicit ablation command or starts the TUI with automatic updates enabled.
Impact
No concrete malicious effect was established from the inspected source.
Mechanism
Ablation runs fixed measurement tasks; the TUI checks the registry and can install a newer @hmharness/cli release.
AI rationale
The install-like subprocess is explicitly invoked for an ablation task, while the TUI updater is package-aligned and installs this CLI from its registry. The inspected source does not establish malicious behavior.
Network endpoints1
registry.npmjs.org/-/package/@hmharness/cli/dist-tags
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a build script and lists matching @hmharness dependencies.
- dist/main.js loads the ablation task only when the user supplies --task.
- dist/ablate-task.js runs fixed measurement tasks in a hard-coded project directory; its subprocess is not an install hook.
- The TUI checks for updates against the npm registry and its updater installs a newer release of this same CLI package.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/ablate-task.jsView file
14*/
L15: import { spawn } from 'node:child_process';
L16: import { appendFile, mkdir } from 'node:fs/promises';
High
Child Process
Package source references child process execution.
dist/ablate-task.jsView on unpkg · L1431cwd: 'G:/hmharness',
L32: shell: true,
L33: env: { ...process.env, ...(bare ? { HMH_NO_COGNITIVE: '1' } : {}) },
High
29return new Promise((resolve) => {
L30: const child = spawn('npx', ['tsx', 'packages/cli/src/main.ts', '--yes', task], {
L31: cwd: 'G:/hmharness',
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/ablate-task.jsView on unpkg · L29dist/main.jsView file
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/tui.js
HighChild Processdist/ablate-task.js
HighShelldist/ablate-task.js
HighCopied Package Dependency Bridgedist/main.js
HighRuntime Package Installdist/ablate-task.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.21.2.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.21.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.