@hmharness/cli@0.23.48
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 2d ago · by lpm-firewall-ai`hmh web start` silently launches recurring evolution and fine-tuning work through the user’s configured provider, including a paid submission path. This can use the user’s provider credentials and incur costs without a separate request for those actions.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Run `hmh web start`; the evolution daemon starts alongside the web daemon.
Impact
Unrequested provider API use can consume the user’s quota or incur charges, including paid fine-tuning job submission when its gate allows.
Mechanism
The daemon runs evolution cycles with the configured provider, then invokes `auto-finetune --submit`; it starts after 30 seconds and repeats on a schedule.
Attack narrative
Running `hmh web start` silently starts a detached evolution daemon. It uses the configured provider for recurring evolution cycles and invokes `auto-finetune --submit` after each cycle. The daemon begins after 30 seconds and repeats on a schedule, so provider usage and paid fine-tuning submissions can occur without a separate request to evolve or fine-tune.
AI rationale
`hmh web start` silently launches recurring evolution and fine-tuning work through the user’s configured provider, including a paid submission path. This can use the user’s provider credentials and incur costs without a separate request for those actions.
Evidence
dist/main.jsdist/evolution-daemon.js<HMH_HOME>/evolution-daemon-runner.cjs<HMH_HOME>/evolution-daemon.pid<HMH_HOME>/evolution-daemon.log
Network endpoints1
User-configured model provider base URL
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Starting the web daemon also starts the evolution daemon silently.
- Evolution cycles call `evolve` with the provider resolved from the user’s configuration.
- Each cycle runs `auto-finetune --submit` without a separate user request.
- The daemon starts a cycle after 30 seconds and repeats it on a schedule.
- The package describes fine-tuning job creation as paid, while the daemon supplies the submit flag.
Evidence against
- The manifest has no install, preinstall, or postinstall hook.
- The package is an AI CLI, and the model provider is user-configured.
- The board installer is a separate command that downloads first-party packages from npm.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedboard/install-kaihongos.cjsView file
38const https = require('https');
L39: const { spawnSync } = require('child_process');
L40: // board config defaults live in a shared module that ships in
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L38dist/web-daemon.jsView file
79try {
L80: const out = execSync(`powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}').CommandLine"`, { encoding: 'utf8', timeout: 8000 });
L81: const cmd = out.trim();
High
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.43
matchedPath = dist/web-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.43
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web-daemon.jsView on unpkgboard/board-defaults.cjsView file
35function ensureBoardDefaults(configPath) {
L36: const fs = require('fs');
L37: let raw;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
board/board-defaults.cjsView on unpkg · L35dist/extension-daemon.jsView file
10Trigger-reachable persistence chain: manifest.main -> dist/main.js -> dist/extension-daemon.js
L10: */
L11: import { spawn, execSync } from 'node:child_process';
L12: import { createRequire } from 'node:module';
...
L19: try {
L20: const p = Number(readFileSync(join(homeDir(), 'extension.pid'), 'utf8').trim());
L21: return Number.isFinite(p) && p > 0 ? p : 0;
...
L37: try {
L38: const r = await fetch(`http://127.0.0.1:${port}/v1/status`, { signal: AbortSignal.timeout(1500) });
L39: if (!r.ok)
L40: return { up: false, connected: false };
L41: const d = await r.json();
L42: const up = d?.ok === true && d?.protocol === 'hmext/1';
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/extension-daemon.jsView on unpkg · L1010*/
L11: import { spawn, execSync } from 'node:child_process';
L12: import { createRequire } from 'node:module';
...
L19: try {
L20: const p = Number(readFileSync(join(homeDir(), 'extension.pid'), 'utf8').trim());
L21: return Number.isFinite(p) && p > 0 ? p : 0;
...
L37: try {
L38: const r = await fetch(`http://127.0.0.1:${port}/v1/status`, { signal: AbortSignal.timeout(1500) });
L39: if (!r.ok)
L40: return { up: false, connected: false };
L41: const d = await r.json();
L42: const up = d?.ok === true && d?.protocol === 'hmext/1';
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/extension-daemon.jsView on unpkg · L10board/heal-tree.cjsView file
27const path = require('path');
L28: const https = require('https');
L29: const { spawnSync } = require('child_process');
L30:
...
L32: // installs; the launcher hook exports HMH_BOARD_HOME before invoking it.
L33: const BOARD_HOME = process.env.HMH_BOARD_HOME || '/data/local/home';
L34: const HROOT = path.join(BOARD_HOME, '.local', 'hmharness');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/heal-tree.cjsView on unpkg · L27•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.43
matchedPath = board/heal-tree.cjs
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.43
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
board/heal-tree.cjsView on unpkgdist/main.jsView file
33package = @hmharness/cli; repositoryIdentity = hmharness; dependency = @hmharness/agent
L33: import { harmonyTools } from '@hmharness/domain-harmony';
L34: import { baseTools, buildRegistry, buildSystemPrompt, runAgentTask, strings } from '@hmharness/agent';
L35: const DIM = (s) => `\x1b[2m${s}\x1b[0m`;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.43
matchedPath = dist/main.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.43
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/main.jsView on unpkgdist/extension-daemon.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/extension-daemon.js#virtual:normalized:round1View on unpkgdist/evolution-daemon.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.43
matchedPath = dist/evolution-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.43
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/evolution-daemon.jsView on unpkgdist/update-check.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.43
matchedPath = dist/update-check.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.43
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/update-check.jsView on unpkgdist/acp-serve.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.43
matchedPath = dist/acp-serve.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.43
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/acp-serve.jsView on unpkgFindings
12 High5 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/heal-tree.cjs
HighCopied Package Dependency Bridgedist/main.js
HighTrigger Reachable Persistencedist/extension-daemon.js
HighSemantic Analysis Limiteddist/extension-daemon.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/web-daemon.js
HighKnown Malware Source Similarityboard/heal-tree.cjs
HighKnown Malware Source Similaritydist/evolution-daemon.js
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/update-check.js
HighKnown Malware Source Similaritydist/acp-serve.js
MediumDynamic Requireboard/board-defaults.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/extension-daemon.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.48.
See all versions of @hmharness/cli for other recorded verdicts.
- Avoid installing @hmharness/cli@0.23.48. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.