@hone-ai/cli@1.19.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@hone-ai/cli@1.19.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = echo '\n Hone AI CLI installed successfully.\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\n Docs: https://github.com/subbareddyvani/hone-server\n'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = echo '\n Hone AI CLI installed successfully.\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\n Docs: https://github.com/subbareddyvani/hone-server\n'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hone-cli.jsView file

24const crypto = require('crypto'); L25: const { execSync } = require('child_process'); L26:

High

Child Process

Package source references child process execution.

hone-cli.jsView on unpkg · L24

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. hone-cli.js: baseURL: config.apiUrl, Authorization: `Bearer ${config.token}`, fs.writeFileSync(target, f.content); fs.writeFileSync(pipelineConfigPath, updated); fs.writeFileSync(configPath, result.augmentedConfig); write: (data) => fs.writeFileSync(path.join(agentsDir, `${agent}.agent.md`), data), fs.writeFileSync(path.join(skillDir, 'SKILL.md'), data); write: (data) => fs.writeFileSync(path.join(enterpriseGH, 'copilot-instructions.md'), data),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

hone-cli.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. hone-cli.js: const apiUrl = process.env.HONE_API || rc.api || 'https://api.hone.ai'; // HC-019y-followup-3: module-level upgrade-warning bucket. Set by the // HC-101-followup-3: server-side recommendation buckets, surfaced via // HC-019y-followup-3: response interceptor reads server's // HC-101-followup-3: server can recommend config changes via // HC-019y-followup-3: emit the upgrade warning at process exit if set. // HC-101-followup-3: flush any server-side recommendations queued by // ── SETUP-LOCAL-CI command (HC-101-followup-3) ─────────────────────────────────

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

hone-cli.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. c.config.length + mc.test.length; console.log(` ${p}: ${total} metadata types, ${data.selecteddocs.length} doc urls, mcp: ${data.mcp.available ? 'available' : 'not detected'}`); } for (const w of (result.warnings || [])) console.log(` ⚠ ${w}`); } else { console.log(`ℹ refresh skipped: ${result.reason}`); } return; } console.log('hone ai — pipeline setup'); console.log('=============================='); console.log(''); let orgconfig; try { const r = await client.get('/scripts/config'); orgconfig = r.data; console.log(`org:

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

hone-cli.jsView on unpkg

1029L1030: const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D'; L1031: ... L1037: try { L1038: execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot }); L1039: console.log(` ✓ Unit test framework installed`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hone-cli.jsView on unpkg · L1029

lib/security-scanner.jsView file

45severity: 'HIGH', L46: message: 'eval() usage detected. Avoid eval with dynamic input — use safe alternatives.', L47: },

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/security-scanner.jsView on unpkg · L45

bin/hone.jsView file

1#!/usr/bin/env node L2: require('../hone-cli.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hone.jsView on unpkg · L1

lib/hook-templates/pre-push.shView file

•path = lib/hook-templates/pre-push.sh kind = build_helper sizeBytes = 2812 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/hook-templates/pre-push.shView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@hone-ai/cli",

3 "version": "1.19.0",

4 "description": "Hone AI — Enterprise SDLC Pipeline CLI",

5 "main": "hone-cli.js",

6 "bin": {

7 "hone": "./bin/hone.js"

8 },

9 "files": [

10 "bin/",

11 "hone-cli.js",

12 "lib/",

13 "!lib/*.test.js",

14 "schema/"

15 ],

16 "scripts": {

17 "test": "echo \"No tests yet\" && exit 0",

18 "link": "npm link",

19 "sync-server-cli-version": "node scripts/sync-server-cli-version.js",

20 "prepublishOnly": "node scripts/sync-server-cli-version.js",

21 "postinstall": "echo '\\n Hone AI CLI installed successfully.\\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\\n Docs: https://github.com/subbareddyvani/hone-server\\n'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 },

23 "dependencies": {

24 "ajv": "^8.20.0",

25 "axios": "^1.6.0",

26 "commander": "^11.0.0",

27 "js-yaml": "^4.1.0"

28 },

29 "engines": {

30 "node": ">=18.0.0"

31 },

32 "keywords": [

33 "hone",

34 "ai",

35 "sdlc",

36 "pipeline",

37 "enterprise",

38 "developer-tools"

39 ],

40 "author": "Hone AI",

41 "license": "UNLICENSED",

hone-cli.jsView file

Lines 4-44javascript

4 * @hone-ai/cli — Hone AI Command Line Interface

5 *

6 * Bridges the gap between setup-ai-pipeline.sh v3.1 and the Hone server.

7 * The key insight: setup

lib/security-scanner.jsView file

Lines 25-65javascript

25 message: 'Hardcoded password/secret detected. Use environment variables or a vault.',

26 },

27 {

28 id: 'hardcoded-secret-aws',

29 pattern: /AKIA[0-9A-Z]{16}/,

30 severity

bin/hone.jsView file

Lines 1-3javascript

1#!/usr/bin/env node

2require('../hone-cli.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hone.jsView on unpkg · L1

3

lib/hook-templates/pre-push.shView file

•path = lib/hook-templates/pre-push.sh kind = build_helper sizeBytes = 2812 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/hook-templates/pre-push.shView on unpkg

Lines 1009-1049javascript

1009 const installE2e = opts && opts.e2e !== false && opts.noE2e !== true;

1010 if (installE2e) {

1011 console.log('');

1012 console.log(` Skipping Playwright (Python) e2e auto-install — adopters opt in via \`pip install pytest-playwright\` separately.`);

1013 console.log(` See pytest-playwright docs for details.`);

1014 }

1015}

1016

1017async function installTestFramework(repoRoot, opts) {

1018 console.log('');

1019 console.log('── Test Framework Setup ────────────────────────────────');

1020 console.log('');

1021

1022 const detected = detectExistingTestFramework(repoRoot);

1023 const pkgs = getInstallPackages(detected.stack);

1024

1025 // H-002b: Python branch — different install commands + pyproject.toml (not package.json)

1026 if (pkgs.pkgManagerKind === 'python') {

1027 return installPythonTestFramework(repoRoot, detected, pkgs, opts);

1028 }

1029

1030 const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D';

1031

1032 // ── Unit test framework ────────────────────────────────

1033 if (detected.testFw) {

1034 console.log(` Test framework detected: ${detected.testFw} ✓ (skipping install)`);

1035 } else {

1036 console.log(` Stack: ${detected.stack} → Installing: ${pkgs.unit.join(', ')}`);

1037 try {

1038 execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot });

1039 console.log(` ✓ Unit test framework installed`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hone-cli.jsView on unpkg · L1029

1040 } catch (e) {

1041 console.error(` ✗ Install failed: ${e.message}`);

1042 return;

1043 }

1044 }

1045

1046 // ── Test config file ───────────────────────────────────

1047 if (detected.hasTestConfig) {

1048 console.log(` Test config exists ✓ (skipping creation)`);

1049 } else {