@hmharness/cli@0.23.50
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe web-start path silently launches recurring evolution and fine-tuning that use the configured provider key and can create paid jobs. The thresholds and opt-out reduce frequency but do not provide consent for automatic model use, data upload, or spending.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running `hmh web start`; the daemon then runs its first cycle after 30 seconds and repeats every six hours by default.
Impact
Unexpected provider charges and automatic transfer of training examples to the configured fine-tuning backend. Label thresholds, cooldowns, and an opt-out limit this behavior but do not make it user-requested.
Mechanism
The background process runs `evolve`, then calls `auto-finetune --submit`. When its gates pass, the CLI uploads labeled training data using the configured provider key and creates a paid fine-tuning job.
Attack narrative
Starting the web server silently enables a recurring background agent that uses the configured provider account for model calls and, when its gates pass, uploads labeled training data and submits a paid fine-tuning job without a separate user request.
AI rationale
The web-start path silently launches recurring evolution and fine-tuning that use the configured provider key and can create paid jobs. The thresholds and opt-out reduce frequency but do not provide consent for automatic model use, data upload, or spending.
Evidence
dist/main.jsdist/evolution-daemon.js<HMH_HOME>/evolution-daemon-runner.cjs<HMH_HOME>/evolution-daemon.pid<HMH_HOME>/evolution-daemon.log
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- Starting `hmh web` silently starts the evolution daemon; the source says the user does not trigger `hmh evolve` manually.
- The daemon runs `evolve` after startup and on a six-hour schedule; its source describes 40+ model calls per cycle.
- After each evolution cycle, the daemon invokes `auto-finetune --submit`, which uses the configured provider key to upload training data and create a paid fine-tuning job.
- Fine-tuning is gated on at least 50 labels, a cooldown, no active job, and can be disabled with `finetune.auto=false`.
- The package manifest defines only a build script and no install lifecycle hooks.
Evidence against
- The fine-tuning backend is resolved from the user's configured chat provider and its base URL.
- Automatic fine-tuning has label, cooldown, active-job, and opt-out gates.
- The package has no install, preinstall, or postinstall script.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggedboard/install-kaihongos.cjsView file
38const https = require('https');
L39: const { spawnSync } = require('child_process');
L40: // board config defaults live in a shared module that ships in
High
Child Process
Package source references child process execution.
board/install-kaihongos.cjsView on unpkg · L38•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = board/install-kaihongos.cjs
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
board/install-kaihongos.cjsView on unpkgdist/web-daemon.jsView file
79try {
L80: const out = execSync(`powershell -NoProfile -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}').CommandLine"`, { encoding: 'utf8', timeout: 8000 });
L81: const cmd = out.trim();
High
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/web-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/web-daemon.jsView on unpkgboard/board-defaults.cjsView file
35function ensureBoardDefaults(configPath) {
L36: const fs = require('fs');
L37: let raw;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
board/board-defaults.cjsView on unpkg · L35dist/extension-daemon.jsView file
10Trigger-reachable persistence chain: manifest.main -> dist/main.js -> dist/extension-daemon.js
L10: */
L11: import { spawn, execSync } from 'node:child_process';
L12: import { createRequire } from 'node:module';
...
L19: try {
L20: const p = Number(readFileSync(join(homeDir(), 'extension.pid'), 'utf8').trim());
L21: return Number.isFinite(p) && p > 0 ? p : 0;
...
L37: try {
L38: const r = await fetch(`http://127.0.0.1:${port}/v1/status`, { signal: AbortSignal.timeout(1500) });
L39: if (!r.ok)
L40: return { up: false, connected: false };
L41: const d = await r.json();
L42: const up = d?.ok === true && d?.protocol === 'hmext/1';
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/extension-daemon.jsView on unpkg · L10•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/extension-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/extension-daemon.jsView on unpkg10*/
L11: import { spawn, execSync } from 'node:child_process';
L12: import { createRequire } from 'node:module';
...
L19: try {
L20: const p = Number(readFileSync(join(homeDir(), 'extension.pid'), 'utf8').trim());
L21: return Number.isFinite(p) && p > 0 ? p : 0;
...
L37: try {
L38: const r = await fetch(`http://127.0.0.1:${port}/v1/status`, { signal: AbortSignal.timeout(1500) });
L39: if (!r.ok)
L40: return { up: false, connected: false };
L41: const d = await r.json();
L42: const up = d?.ok === true && d?.protocol === 'hmext/1';
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/extension-daemon.jsView on unpkg · L10board/heal-tree.cjsView file
27const path = require('path');
L28: const https = require('https');
L29: const { spawnSync } = require('child_process');
L30:
...
L32: // installs; the launcher hook exports HMH_BOARD_HOME before invoking it.
L33: const BOARD_HOME = process.env.HMH_BOARD_HOME || '/data/local/home';
L34: const HROOT = path.join(BOARD_HOME, '.local', 'hmharness');
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
board/heal-tree.cjsView on unpkg · L27•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = board/heal-tree.cjs
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
board/heal-tree.cjsView on unpkgdist/main.jsView file
33package = @hmharness/cli; repositoryIdentity = hmharness; dependency = @hmharness/agent
L33: import { harmonyTools } from '@hmharness/domain-harmony';
L34: import { baseTools, buildRegistry, buildSystemPrompt, runAgentTask, strings } from '@hmharness/agent';
L35: const DIM = (s) => `\x1b[2m${s}\x1b[0m`;
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/main.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/main.jsView on unpkgdist/extension-daemon.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/extension-daemon.js#virtual:normalized:round1View on unpkgdist/tui.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/tui.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/tui.jsView on unpkgdist/evolution-daemon.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/evolution-daemon.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/evolution-daemon.jsView on unpkgdist/update-check.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/update-check.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/update-check.jsView on unpkgdist/acp-serve.jsView file
•matchType = normalized_sha256
matchedPackage = @hmharness/cli@0.23.49
matchedPath = dist/acp-serve.js
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.49
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/acp-serve.jsView on unpkgdist/tui-mouse.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @hmharness/cli@0.23.46
matchedIdentity = npm:QGhtaGFybmVzcy9jbGk:0.23.46
similarity = 0.955
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/tui-mouse.jsView on unpkgFindings
16 High5 Medium4 Low
HighChild Processboard/install-kaihongos.cjs
HighShelldist/web-daemon.js
HighSame File Env Network Executionboard/heal-tree.cjs
HighCopied Package Dependency Bridgedist/main.js
HighTrigger Reachable Persistencedist/extension-daemon.js
HighSemantic Analysis Limiteddist/extension-daemon.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/web-daemon.js
HighKnown Malware Source Similaritydist/extension-daemon.js
HighKnown Malware Source Similaritydist/tui.js
HighKnown Malware Source Similarityboard/heal-tree.cjs
HighKnown Malware Source Similarityboard/install-kaihongos.cjs
HighKnown Malware Source Similaritydist/evolution-daemon.js
HighKnown Malware Source Similaritydist/main.js
HighKnown Malware Source Similaritydist/update-check.js
HighKnown Malware Source Similaritydist/acp-serve.js
HighPrevious Version Dangerous Deltadist/tui-mouse.js
MediumDynamic Requireboard/board-defaults.cjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/extension-daemon.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.50.
See all versions of @hmharness/cli for other recorded verdicts.
- Avoid installing @hmharness/cli@0.23.50. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.