@hmharness/cli@0.23.43
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package silently starts a background daemon from the web command, and that daemon can submit paid fine-tuning jobs using the user's configured provider account. The opt-out and thresholds do not constitute a specific request to spend funds.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user starts the web command; the detached daemon then runs on a schedule.
Impact
May upload user-generated training data and incur provider charges without a specific request to create a fine-tuning job.
Mechanism
The daemon invokes `auto-finetune --submit`, which uses the configured provider credentials and uploaded preference data to create a fine-tuning job unless the user has explicitly disabled automatic fine-tuning.
Attack narrative
Starting the web command silently starts a detached evolution daemon. On its schedule, the daemon invokes automatic fine-tuning with `--submit`; unless `finetune.auto=false` is configured, the CLI can use the configured provider credentials and uploaded training data to create a paid job without a specific user request.
AI rationale
The package silently starts a background daemon from the web command, and that daemon can submit paid fine-tuning jobs using the user's configured provider account. The opt-out and thresholds do not constitute a specific request to spend funds.
Evidence
dist/main.jsdist/evolution-daemon.jsHMH_HOME/evolution-daemon-runner.cjsHMH_HOME/evolution-daemon.pidHMH_HOME/evolution-daemon.log
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The web command silently starts the evolution daemon.
- The daemon periodically invokes `auto-finetune --submit` without a separate user request.
- Submission is skipped only when `finetune.auto` is explicitly false; the command labels job creation as paid.
- The submission path creates a fine-tuning job using the configured provider credentials and uploaded training files.
Evidence against
- package.json declares no install, preinstall, or postinstall lifecycle script.
- The fine-tuning path has thresholds and cooldowns, and users can disable it with `finetune.auto=false`.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedboard/install-kaihongos.cjsView file
35const https = require('https');
L36: const { spawnSync } = require('child_process');
L37:
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L35345log('first run: creating config skeleton at ' + HMH_HOME);
L346: const r = spawnSync(nodeBin, [path.join(NM, '@hmharness', 'cli', 'dist', 'main.js'), 'init'], {
L347: encoding: 'utf8', env: Object.assign({}, process.env, { HMH_HOME, HOME: BOARD_HOME }),
L348: });
...
L355: console.log(' 2. hmh check # verify toolchain');
L356: console.log(' 3. hmh tui # or: hmh web start → http://127.0.0.1:7788');
L357: console.log('pitfalls & details: docs/KAIHONGOS.md');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/install-kaihongos.cjsView on unpkg · L345dist/web-daemon.jsView file
Findings
6 High3 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/install-kaihongos.cjs
HighCopied Package Dependency Bridgedist/main.js
HighSemantic Analysis Limiteddist/web-daemon.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/extension-daemon.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.43.
See all versions of @hmharness/cli for other recorded verdicts.
- Avoid installing @hmharness/cli@0.23.43. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.