@hone-ai/cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@hone-ai/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = echo '\n Hone AI CLI installed successfully.\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\n Docs: https://www.npmjs.com/package/@hone-ai/cli\n'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = echo '\n Hone AI CLI installed successfully.\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\n Docs: https://www.npmjs.com/package/@hone-ai/cli\n'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hone-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hone-ai/cli@1.34.0 matchedIdentity = npm:QGhvbmUtYWkvY2xp:1.34.0 similarity = 0.761 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hone-cli.jsView on unpkg

25const crypto = require('crypto'); L26: const { execSync } = require('child_process'); L27:

High

Child Process

Package source references child process execution.

hone-cli.jsView on unpkg · L25

8127const probed = spawnSync(plan.probe, { L8128: cwd: process.cwd(), shell: true, encoding: 'utf8', L8129: timeout: 60_000, env: verifyCommandEnv(gitEnv()), stdio: ['ignore', 'pipe', 'pipe'],

High

Shell

Package source references shell execution.

hone-cli.jsView on unpkg · L8127

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. hone-cli.js: baseURL: config.apiUrl, Authorization: `Bearer ${config.token}`, fs.writeFileSync(target, f.content); fs.writeFileSync(pipelineConfigPath, updated); fs.writeFileSync(configPath, result.augmentedConfig); fs.writeFileSync(path.join(agentsDir, `${agent}.agent.md`), data), fs.writeFileSync(path.join(skillDir, 'SKILL.md'), data); write: (data) => fs.writeFileSync(path.join(enterpriseGH, 'copilot-instructions.md'), data),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

hone-cli.jsView on unpkg

1333L1334: const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D'; L1335: ... L1341: try { L1342: execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot }); L1343: console.log(` ✓ Unit test framework installed`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hone-cli.jsView on unpkg · L1333

bin/hone-mcp.jsView file

6// detached-ok: top-level entrypoint - the process lifetime IS the await, and no caller exists to observe it L7: require('../mcp-server.js').start().catch((e) => { L8: process.stderr.write(`hone-mcp failed: ${e && e.message ? e.message : String(e)}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hone-mcp.jsView on unpkg · L6

lib/hook-templates/pre-push.shView file

•path = lib/hook-templates/pre-push.sh kind = build_helper sizeBytes = 2812 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/hook-templates/pre-push.shView on unpkg

lib/auto-verify.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/auto-verify.js#virtual:normalized:round1View on unpkg

lib/performance-analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = @hone-ai/cli@1.28.0 matchedPath = lib/performance-analyzer.js matchedIdentity = npm:QGhvbmUtYWkvY2xp:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/performance-analyzer.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 4-44json

4 "description": "Hone AI — Enterprise SDLC Pipeline CLI",

5 "main": "hone-cli.js",

6 "bin": {

7 "hone": "./bin/hone.js",

8 "hone-mcp": "./bin/hone-mcp.js"

9 },

10 "files": [

11 "README.md",

12 "bin/",

13 "hone-cli.js",

14 "lib/",

15 "!lib/*.test.js",

16 "schema/",

17 "mcp-server.js"

18 ],

19 "scripts": {

20 "test": "echo \"No tests yet\" && exit 0",

21 "link": "npm link",

22 "sync-server-cli-version": "node scripts/sync-server-cli-version.js",

23 "prepublishOnly": "node scripts/sync-server-cli-version.js",

24 "postinstall": "echo '\\n Hone AI CLI installed successfully.\\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\\n Docs: https://www.npmjs.com/package/@hone-ai/cli\\n'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 },

26 "dependencies": {

27 "@modelcontextprotocol/sdk": "^1.30.0",

28 "ajv": "^8.20.0",

29 "axios": "^1.20.0",

30 "commander": "^11.0.0",

31 "js-yaml": "^4.3.2"

32 },

33 "engines": {

34 "node": ">=18.0.0"

35 },

36 "keywords": [

37 "hone",

38 "ai",

39 "sdlc",

40 "pipeline",

41 "enterprise",

42 "developer-tools"

43 ],

44 "author": "Hone AI",

hone-cli.jsView file

Lines 5-45javascript

5 *

6 * Bridges the gap between setup-ai-pipeline.sh v3.1 and the Hone server.

7 * The key insight: setup-ai-pipeline.sh needs ENTERPRISE_SOURCE = enterprise-github

bin/hone-mcp.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

2'use strict';

3// HC-COMM-012 (A1 P1): entry point for the Hone MCP server (stdio).

4// Registered by the Claude Code plugin's .mcp.json as `npx -y @hone-ai/cli hone-mcp`

5// (or `hone-mcp` once installed). Delegates to ../mcp-server.js `start()`.

6// detached-ok: top-level entrypoint - the process lifetime IS the await, and no caller exists to observe it

7require('../mcp-server.js').start().catch((e)

lib/hook-templates/pre-push.shView file

•path = lib/hook-templates/pre-push.sh kind = build_helper sizeBytes = 2812 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/hook-templates/pre-push.shView on unpkg

lib/auto-verify.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/auto-verify.js#virtual:normalized:round1View on unpkg

lib/performance-analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = @hone-ai/cli@1.28.0 matchedPath = lib/performance-analyzer.js matchedIdentity = npm:QGhvbmUtYWkvY2xp:1.28.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/performance-analyzer.jsView on unpkg

Lines 1313-1353javascript

1313 const installE2e = opts && opts.e2e !== false && opts.noE2e !== true;

1314 if (installE2e) {

1315 console.log('');

1316 console.log(` Skipping Playwright (Python) e2e auto-install — adopters opt in via \`pip install pytest-playwright\` separately.`);

1317 console.log(` See pytest-playwright docs for details.`);

1318 }

1319}

1320

1321async function installTestFramework(repoRoot, opts) {

1322 console.log('');

1323 console.log('── Test Framework Setup ────────────────────────────────');

1324 console.log('');

1325

1326 const detected = detectExistingTestFramework(repoRoot);

1327 const pkgs = getInstallPackages(detected.stack);

1328

1329 // H-002b: Python branch — different install commands + pyproject.toml (not package.json)

1330 if (pkgs.pkgManagerKind === 'python') {

1331 return installPythonTestFramework(repoRoot, detected, pkgs, opts);

1332 }

1333

1334 const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D';

1335

1336 // ── Unit test framework ────────────────────────────────

1337 if (detected.testFw) {

1338 console.log(` Test framework detected: ${detected.testFw} ✓ (skipping install)`);

1339 } else {

1340 console.log(` Stack: ${detected.stack} → Installing: ${pkgs.unit.join(', ')}`);

1341 try {

1342 execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot });

1343 console.log(` ✓ Unit test framework installed`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hone-cli.jsView on unpkg · L1333

1344 } catch (e) {

1345 console.error(` ✗ Install failed: ${e.message}`);

1346 return;

1347 }

1348 }

1349

1350 // ── Test config file ───────────────────────────────────

1351 if (detected.hasTestConfig) {

1352 console.log(` Test config exists ✓ (skipping creation)`);

1353 } else {

Lines 8107-8147javascript

8107 // fix; it does not quietly fall through to "tests passed", which would report a green

8108 // verdict for code whose stored-state behaviour was never exercised.

8109 try {

8110 const { readSandboxConfig, assertScratchTarget } = require('./lib/pipeline-config');

8111 const { planSandboxRun, parseProbeOutput, describeProbeResult, sandboxSuiteVerdict } = require('./lib/sandbox-lifecycle');

8112 const plan = planSandboxRun({

8113 sandbox: readSandboxConfig(process.cwd()),

8114 axes: runConfig?.classifier_axes || runConfig?.axes || [],

8115 capability: runConfig?.capability || null,

8116 });

8117 if (plan.refuse) {

8118 emit({ ok: false, verdict: 'sandbox_refused', detail: plan.reason },

8119 `✗ sandbox refused: ${plan.reason}`);

8120 exitCode = EXIT.FAIL;

8121 reportVerdict = 'sandbox_refused'; reportDetail = plan.reason;

8122 throw new Error('sandbox refused');

8123 }

8124 if (plan.engage) {

8125 // The probe runs in the REAL tree, not the worktree: it reads the adopter's live

8126 // datastore, which the worktree does not change.

8127 const probed = spawnSync(plan.probe, {

8128 cwd: process.cwd(), shell: true, encoding: 'utf8',

8129 timeout: 60_000, env: verifyCommandEnv(gitEnv()), stdio: ['ignore', 'pipe', 'pipe'],

High

Shell

Package source references shell execution.

hone-cli.jsView on unpkg · L8127

8130 });

8131 // A probe that exited non-zero is not evidence, whatever it left on stdout — a

8132 // command that fails partway can still print a stale or partial line, and reading it

8133 // would turn a failed check into a pass.

8134 if (probed.status !== 0) {

8135 throw new Error(`sandbox probe exited ${probed.status === null ? 'abnormally' : probed.status}`

8136 + ` (${plan.probe}): ${((probed.stderr || '').split('\n')[0] || 'no stderr')}`);

8137 }

8138 // The guard reads the LIVE connection and nothing else (HC-GF-169).

8139 const probeEvidence = parseProbeOutput(probed.stdout);

8140 assertScratchTarget(plan.verify, probeEvidence);

8141 // HC-GF-190: say what the guard PROVED. It throws on refusal and returns nothing on

8142 // success, so a passing guard was silent — and HC-GF-185's acceptance ("the output

8143 // shows the probe, the guard verdict and the teardown") stayed open on run 6be117b3,

8144 // where all three had in fact happened. Printed after the check and before the first

8145 // write, so it describes something that has already occurred.

8146 if (opts.format !== 'json') console.log(` sandbox: ${describeProbeResult(plan.verify, probeEvidence)}`);

8147 // Armed BEFORE the first command, not after the last. `create` succeeding and