@hmharness/cli@0.23.9
hmharness command line: one-shot tasks, an interactive REPL, a fullscreen TUI, the web frontend, and direct tool invocation.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe inspected manifest and entrypoint behavior support a clean verdict: no install-time hook or concrete attack behavior was found. Scanner signals are consistent with package-aligned update and statistics features and user-invoked local TUI actions.
Decision evidence
public snapshot- package.json has only a build script and depends on matching @hmharness packages; no install lifecycle hook is declared.
- The CLI update check is loaded from an interactive REPL path and uses the npm registry for version lookup.
- The TUI invokes git only for the user-entered /diff command, scoped to the current working directory.
Source & flagged code
5 flaggedPackage metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/main.jsView on unpkg · L33The CLI update check is loaded from an interactive REPL path and uses the npm registry for version lookup.
dist/main.jsView on unpkg · L117Findings
Affected versions and remediation
This report applies to @hmharness/cli@0.23.9.
See all versions of @hmharness/cli for other recorded verdicts.
- Review the evidence and your use of @hmharness/cli@0.23.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.