@hmharness/cli@0.23.32
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe source shows persistent browser extension setup behind an explicit CLI subcommand, so this warrants a warning for extension lifecycle risk. The manifest has no install lifecycle hook, and the inspected source does not establish a separate malicious chain.
Decision evidence
public snapshot- The CLI is exposed through the `hmh` command, and the manifest has no install lifecycle hook.
- Persistent browser extension installation is reached through the explicit `hmh extension install` subcommand and targets discovered browsers.
- After that command, the CLI attempts to start the extension bridge daemon.
- The package manifest lists only a build script and pins its first-party runtime dependencies to the same release.
- The web daemon probe contacts loopback, and the inspected excerpt shows no remote endpoint.
Source & flagged code
5 flaggedPackage source references child process execution.
board/install-kaihongos.cjsView on unpkg · L35A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L339Findings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.32.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.