registry / @hmharness/cli / 0.23.39
@hmharness/cli@0.23.39
⚠ Under reviewhmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged board installer is a separately invoked setup utility. Several selected first-party runtime dependencies remain unresolved in this inspection, so the package cannot be cleared as clean.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Launching the CLI reaches its first-party runtime imports.
Impact
No attack impact is confirmed, but the unresolved runtime sources prevent a clean verdict.
Mechanism
The inspected entrypoints import packages including the kernel and evolution layers; several declared runtime dependency implementations were outside the inspected source.
AI rationale
The manifest has no install lifecycle hook, and the flagged board installer is a separately invoked setup utility. Several selected first-party runtime dependencies remain unresolved in this inspection, so the package cannot be cleared as clean.
Evidence
package.jsondist/main.jsdist/tui.js
Decision evidence
public snapshotAI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json exposes dist/main.js and defines only a build script, with no install lifecycle hook.
- The CLI imports first-party kernel and evolution packages at runtime, and its manifest declares additional first-party dependencies whose runtime source was not resolved in this inspection.
- The board installer documents explicit command-line invocation and installs its repair layer into board-specific state.
Evidence against
- The inspected manifest has no preinstall, install, or postinstall script.
- The board installer’s documented installation and repair setup is activated by running that installer.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedboard/install-kaihongos.cjsView file
35const https = require('https');
L36: const { spawnSync } = require('child_process');
L37:
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L35339log('first run: creating config skeleton at ' + HMH_HOME);
L340: const r = spawnSync(nodeBin, [path.join(NM, '@hmharness', 'cli', 'dist', 'main.js'), 'init'], {
L341: encoding: 'utf8', env: Object.assign({}, process.env, { HMH_HOME, HOME: BOARD_HOME }),
L342: });
...
L349: console.log(' 2. hmh check # verify toolchain');
L350: console.log(' 3. hmh tui # or: hmh web start → http://127.0.0.1:7788');
L351: console.log('pitfalls & details: docs/KAIHONGOS.md');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L339dist/web-daemon.jsView file
Findings
6 High3 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/install-kaihongos.cjs
HighCopied Package Dependency Bridgedist/main.js
HighSemantic Analysis Limiteddist/web-daemon.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/tui.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.39.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.