@hmharness/cli@0.22.3
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe default updater has a conditional command-execution recovery path whose validation does not tightly constrain the command, so a warning is appropriate. The manifest has no install lifecycle hook, and the inspected code does not show a concrete malicious payload or attack.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting the TUI with auto-update enabled, followed by an update installation failure.
Impact
A crafted or unsafe repair command could execute unintended commands during the update recovery path. No active attack was established from the inspected source.
Mechanism
The repair path extracts a command from model output and validates it with a short denylist plus a check that it mentions the CLI package; Windows execution uses cmd.exe.
AI rationale
The default updater has a conditional command-execution recovery path whose validation does not tightly constrain the command, so a warning is appropriate. The manifest has no install lifecycle hook, and the inspected code does not show a concrete malicious payload or attack.
Evidence
dist/update-check.jspackage.jsondist/tui.js
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The TUI enables background auto-update by default unless its configuration explicitly disables it.
- If a standard update fails, the package parses a model-proposed command and checks it with a blacklist and a package-name substring test before spawning it.
- On Windows, the accepted command is passed to cmd.exe; the validation does not enforce a single exact install command.
Evidence against
- The manifest has no preinstall, install, or postinstall hook; it declares only a build script.
- The updater checks the npm registry and is scoped to updating this same CLI package.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/main.jsView file
33package = @hmharness/cli; repositoryIdentity = hmharness; dependency = @hmharness/agent
L33: import { harmonyTools } from '@hmharness/domain-harmony';
L34: import { baseTools, buildRegistry, buildSystemPrompt, runAgentTask, strings } from '@hmharness/agent';
L35: const DIM = (s) => `\x1b[2m${s}\x1b[0m`;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33dist/tui.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @hmharness/cli@0.15.0
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.15.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/tui.jsView on unpkg1728if (cfg.tui?.autoUpdate === false) {
void notifyUpdate(home, current, (latest) => rt.addText(`↑ ${t.updateHint(latest)}`, 'dim'));
}
else {
void autoU
Findings
2 High6 Medium4 Low
HighCopied Package Dependency Bridgedist/main.js
HighPrevious Version Dangerous Deltadist/tui.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/tui.js
MediumAi Review Evidencedist/update-check.js
MediumAi Review Evidencedist/update-check.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.22.3.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.22.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.