@hmharness/cli@0.23.24
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged installer is explicitly invoked by a user to set up the same-vendor CLI. The inspected network, process, and editor behavior is consistent with those workflows; no concrete malicious behavior was found.
Decision evidence
public snapshot- package.json defines only a build script; no install lifecycle hook is present.
- The board installer performs its work when run as a script and downloads the package’s @hmharness components from the npm registry.
- dist/main.js is a Node CLI entrypoint that imports the package’s application modules.
- dist/tui.js starts the configured text editor to edit a user draft.
Source & flagged code
4 flaggedPackage source references child process execution.
board/install-kaihongos.cjsView on unpkg · L32A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L251Findings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.24.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.