registry / @hmharness/cli / 0.23.21
@hmharness/cli@0.23.21
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiSource inspection found no install lifecycle hook or active attack behavior. The flagged installer and clipboard operations are user-invoked and consistent with the CLI’s board setup and interactive features.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI runs when invoked; board installation runs when a user explicitly executes board/install-kaihongos.cjs; clipboard copying requires /copy.
Impact
No confirmed unconsented package-install mutation, credential exfiltration, or other attack surface was established.
Mechanism
The manifest has no install lifecycle hook. The installer fetches and stages first-party packages and writes launchers during its own execution; the TUI clipboard operation is user-command gated.
AI rationale
Source inspection found no install lifecycle hook or active attack behavior. The flagged installer and clipboard operations are user-invoked and consistent with the CLI’s board setup and interactive features.
Evidence
board/install-kaihongos.cjs
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines only a build script and has no preinstall, install, or postinstall hook.
- board/install-kaihongos.cjs performs package resolution only when its installer routine is explicitly run; its documented purpose is board setup.
- dist/main.js is a command-line entry point that dispatches user-supplied arguments.
- dist/tui.js copies the last AI response only after the user invokes /copy.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggedboard/install-kaihongos.cjsView file
32const https = require('https');
L33: const { spawnSync } = require('child_process');
L34:
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L32251log('first run: creating config skeleton at ' + HMH_HOME);
L252: const r = spawnSync(nodeBin, [path.join(NM, '@hmharness', 'cli', 'dist', 'main.js'), 'init'], {
L253: encoding: 'utf8', env: Object.assign({}, process.env, { HMH_HOME, HOME: BOARD_HOME }),
L254: });
...
L261: console.log(' 2. hmh check # verify toolchain');
L262: console.log(' 3. hmh tui # or: hmh web start → http://127.0.0.1:7788');
L263: console.log('pitfalls & details: docs/KAIHONGOS.md');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L251dist/main.jsView file
Findings
5 High3 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShell
HighSame File Env Network Executionboard/install-kaihongos.cjs
HighCopied Package Dependency Bridgedist/main.js
HighPrevious Version Dangerous Deltadist/tui.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.21.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.21 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.