@hmharness/cli@0.23.49
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 5d ago · by lpm-firewall-aiStarting `hmh web` silently launches a daemon that periodically submits cloud fine-tuning jobs with the configured provider key. The label threshold, cooldown, and opt-out do not require user approval for a paid submission, so this is malicious under the automatic spending rule.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user starts `hmh web`; the detached daemon begins its scheduled cycles.
Impact
Cloud training may be submitted and charge the user's provider account without an explicit fine-tuning request.
Mechanism
After an evolution cycle, the daemon runs `auto-finetune --submit`. When the label threshold and cooldown gates allow, the CLI creates a cloud fine-tuning job with the configured API key. The default behavior can be disabled with `finetune.auto=false`.
Attack narrative
Starting the web frontend silently launches a detached evolution daemon. Its cycles invoke `auto-finetune --submit`; once its gates pass, the CLI creates a paid cloud training job using the configured provider key. This can spend the user's funds without an explicit request to submit training. A configuration opt-out and cooldown limit the behavior but do not make the default submission user-requested.
AI rationale
Starting `hmh web` silently launches a daemon that periodically submits cloud fine-tuning jobs with the configured provider key. The label threshold, cooldown, and opt-out do not require user approval for a paid submission, so this is malicious under the automatic spending rule.
Evidence
dist/main.jsdist/evolution-daemon.jsHMH_HOME/evolution-daemon-runner.cjsHMH_HOME/evolution-daemon.pidHMH_HOME/evolution-daemon.log
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Starting the web command silently starts the evolution daemon.
- The detached daemon runs evolution cycles and then invokes `auto-finetune --submit`.
- The automatic submission path calls `createFineTuneJob` with the configured provider API key, which can incur paid cloud training.
- Automatic submissions are gated by accumulated labels and a default cooldown, but those gates do not require an explicit submission request.
Evidence against
- The package has no install, preinstall, or postinstall script; the package script shown is for building.
- Automatic fine tuning can be disabled with `finetune.auto=false`, and the code applies label and cooldown gates.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedboard/install-kaihongos.cjsView file
38const https = require('https');
L39: const { spawnSync } = require('child_process');
L40: // board config defaults live in a shared module that ships in
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L38•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = board/install-kaihongos.cjs
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
board/install-kaihongos.cjsView on unpkgdist/web-daemon.jsView file
79try {
L80: const out = execSync(`powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}').CommandLine"`, { encoding: 'utf8', timeout: 8000 });
L81: const cmd = out.trim();
High
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/web-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web-daemon.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = e930a42c73ea782c
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/web-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
shingleOverlap = 18
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/web-daemon.jsView on unpkgboard/board-defaults.cjsView file
35function ensureBoardDefaults(configPath) {
L36: const fs = require('fs');
L37: let raw;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
board/board-defaults.cjsView on unpkg · L35dist/extension-daemon.jsView file
10Trigger-reachable persistence chain: manifest.main -> dist/main.js -> dist/extension-daemon.js
L10: */
L11: import { spawn, execSync } from 'node:child_process';
L12: import { createRequire } from 'node:module';
...
L19: try {
L20: const p = Number(readFileSync(join(homeDir(), 'extension.pid'), 'utf8').trim());
L21: return Number.isFinite(p) && p > 0 ? p : 0;
...
L37: try {
L38: const r = await fetch(`http://127.0.0.1:${port}/v1/status`, { signal: AbortSignal.timeout(1500) });
L39: if (!r.ok)
L40: return { up: false, connected: false };
L41: const d = await r.json();
L42: const up = d?.ok === true && d?.protocol === 'hmext/1';
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/extension-daemon.jsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/extension-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/extension-daemon.jsView on unpkg10*/
L11: import { spawn, execSync } from 'node:child_process';
L12: import { createRequire } from 'node:module';
...
L19: try {
L20: const p = Number(readFileSync(join(homeDir(), 'extension.pid'), 'utf8').trim());
L21: return Number.isFinite(p) && p > 0 ? p : 0;
...
L37: try {
L38: const r = await fetch(`http://127.0.0.1:${port}/v1/status`, { signal: AbortSignal.timeout(1500) });
L39: if (!r.ok)
L40: return { up: false, connected: false };
L41: const d = await r.json();
L42: const up = d?.ok === true && d?.protocol === 'hmext/1';
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/extension-daemon.jsView on unpkg · L10board/heal-tree.cjsView file
27const path = require('path');
L28: const https = require('https');
L29: const { spawnSync } = require('child_process');
L30:
...
L32: // installs; the launcher hook exports HMH_BOARD_HOME before invoking it.
L33: const BOARD_HOME = process.env.HMH_BOARD_HOME || '/data/local/home';
L34: const HROOT = path.join(BOARD_HOME, '.local', 'hmharness');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/heal-tree.cjsView on unpkg · L27•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = board/heal-tree.cjs
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
board/heal-tree.cjsView on unpkgdist/main.jsView file
33package = @hmharness/cli; repositoryIdentity = hmharness; dependency = @hmharness/agent
L33: import { harmonyTools } from '@hmharness/domain-harmony';
L34: import { baseTools, buildRegistry, buildSystemPrompt, runAgentTask, strings } from '@hmharness/agent';
L35: const DIM = (s) => `\x1b[2m${s}\x1b[0m`;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/main.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/main.jsView on unpkgdist/extension-daemon.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/extension-daemon.js#virtual:normalized:round1View on unpkgdist/tui.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/tui.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tui.jsView on unpkgdist/evolution-daemon.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/evolution-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/evolution-daemon.jsView on unpkgdist/update-check.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/update-check.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/update-check.jsView on unpkgdist/acp-serve.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.48
matchedPath = dist/acp-serve.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.48
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/acp-serve.jsView on unpkgFindings
16 High5 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/heal-tree.cjs
HighCopied Package Dependency Bridgedist/main.js
HighTrigger Reachable Persistencedist/extension-daemon.js
HighSemantic Analysis Limiteddist/extension-daemon.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/web-daemon.js
HighKnown Malware Source Similaritydist/extension-daemon.js
HighKnown Malware Source Similaritydist/tui.js
HighKnown Malware Source Similarityboard/heal-tree.cjs
HighKnown Malware Source Similarityboard/install-kaihongos.cjs
HighKnown Malware Source Similaritydist/evolution-daemon.js
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/update-check.js
HighKnown Malware Source Similaritydist/acp-serve.js
HighKnown Malware Source Fingerprint Signaturedist/web-daemon.js
MediumDynamic Requireboard/board-defaults.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/extension-daemon.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.49.
See all versions of @hmharness/cli for other recorded verdicts.
- Avoid installing @hmharness/cli@0.23.49. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.