@hmharness/cli@0.23.15
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection found no install-time attack behavior: the manifest has only a build script, and the separately invoked board installer downloads first-party scoped packages. The flagged TUI behavior is consistent with local CLI features and no concrete malicious action was found.
Decision evidence
public snapshot- package.json defines only a build script and lists first-party @hmharness dependencies; it has no install lifecycle hook.
- The board installer runs as an explicit command and stages packages from registry.npmjs.org under the configured board home.
- The CLI entrypoint describes user-invoked commands; the TUI executes tools through its task interface and contacts a loopback pair-info endpoint.
Source & flagged code
4 flaggedPackage source references child process execution.
board/install-kaihongos.cjsView on unpkg · L32A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L251Findings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.15.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.