@hmharness/cli@0.23.35
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe package has no npm install hook, but its user-started runtime can automatically upload session-derived training data and create a cloud job. This creates a real data disclosure and account-action risk, while the configured provider, safeguards, and opt-out do not establish a publish-blockable attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting the web service or invoking evolve-auto starts the worker; it begins a cycle after a delay and repeats periodically.
Impact
Session-derived data may be disclosed to the configured provider, and a cloud job may be created under that account without a separate submission action.
Mechanism
The worker runs evolution and then auto-finetune --submit. That command builds training pairs from stored session tasks and answers, uploads training data to the configured provider, and can create a fine-tuning job unless automatic fine-tuning is disabled in configuration.
AI rationale
The package has no npm install hook, but its user-started runtime can automatically upload session-derived training data and create a cloud job. This creates a real data disclosure and account-action risk, while the configured provider, safeguards, and opt-out do not establish a publish-blockable attack.
Evidence
dist/main.jsdist/evolution-daemon.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json declares only a build script and version-aligned first-party runtime dependencies; there is no npm install lifecycle hook.
- Starting the web service or invoking evolve-auto starts the evolution worker.
- The worker runs an evolution cycle after a delay, repeats periodically, and invokes auto-finetune --submit.
- The fine-tuning backend is resolved from saved provider settings; submission is skipped only when finetune.auto is explicitly false.
- Training pairs use stored session tasks and answers, are uploaded to that provider, and can be used to create a cloud fine-tuning job.
Evidence against
- The worker is started by CLI commands, and the fine-tuning endpoint comes from the user's saved provider configuration.
- The command has cooldown and active-job checks, and the user can disable automatic fine-tuning with finetune.auto=false.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
5 flaggedboard/install-kaihongos.cjsView file
35const https = require('https');
L36: const { spawnSync } = require('child_process');
L37:
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L35339log('first run: creating config skeleton at ' + HMH_HOME);
L340: const r = spawnSync(nodeBin, [path.join(NM, '@hmharness', 'cli', 'dist', 'main.js'), 'init'], {
L341: encoding: 'utf8', env: Object.assign({}, process.env, { HMH_HOME, HOME: BOARD_HOME }),
L342: });
...
L349: console.log(' 2. hmh check # verify toolchain');
L350: console.log(' 3. hmh tui # or: hmh web start → http://127.0.0.1:7788');
L351: console.log('pitfalls & details: docs/KAIHONGOS.md');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L339dist/web-daemon.jsView file
Findings
4 High4 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/install-kaihongos.cjs
HighCopied Package Dependency Bridgedist/main.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.35.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.