@hmharness/cli@0.23.41
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and the inspected dependency manifests contain only build scripts. The flagged installer is a separate board setup utility, and the daemon probe targets loopback; these inspected behaviors do not establish a package-triggered attack.
Decision evidence
public snapshot- package.json declares only a build script; the inspected dependency manifests also declare only build scripts.
- The CLI and TUI files are command-line frontends that import their runtime modules.
- The board installer is a separately invoked Node script; the manifest does not register it as an install hook.
- The web daemon probe contacts the local loopback address.
Source & flagged code
6 flaggedPackage source references child process execution.
board/install-kaihongos.cjsView on unpkg · L35A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L339Findings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.41.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.41 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.