Loading npm security reports…

@hone-ai/cli@1.28.0: Malicious npm security report (Block) | LPM Firewall

registry / @hone-ai/cli / 1.28.0

@hone-ai/cli@1.28.0

Hone AI — Enterprise SDLC Pipeline CLI

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

An explicit hone setup command retrieves executable server-controlled content and runs it in the current project. Explicit sync can also register a project MCP command and install server-supplied agent content.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running hone setup or hone sync in a consumer project.

Impact

A server-side content change can execute arbitrary shell commands during setup and persist behavior through project workflow, prompt, or MCP files.

Mechanism

Remote script download and execution plus AI-agent control-surface writes.

Attack narrative

After the operator invokes hone setup, the CLI fetches a text shell script, makes it executable, and invokes Bash on it in the operator's repository. The script is not bundled or pinned; its HMAC check occurs only when an optional local secret is present. The same command fetches workflow and reviewer code, while sync can register hone-mcp in .mcp.json. This creates a remote-controlled code and agent-control path.

AI rationale

Although installation itself only displays a message, explicit package commands fetch and execute opaque remote shell content in the consumer project and install server-provided AI control artifacts. The lack of mandatory content verification leaves a concrete remote code execution chain.

Evidence

hone-cli.jslib/mcp-config.jssetup-ai-pipeline.sh.github/workflows/ai-review.yml.github/scripts/ai-reviewer.js.mcp.json.claude/agents/*.agent.md

Network endpoints

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = echo '\n Hone AI CLI installed successfully.\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\n Docs: https://github.com/subbareddyvani/hone-server\n'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = echo '\n Hone AI CLI installed successfully.\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\n Docs: https://github.com/subbareddyvani/hone-server\n'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

hone-cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @hone-ai/cli@1.24.0 matchedIdentity = npm:QGhvbmUtYWkvY2xp:1.24.0 similarity = 0.968 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

hone-cli.jsView on unpkg

25const crypto = require('crypto'); L26: const { execSync } = require('child_process'); L27:

High

Child Process

Package source references child process execution.

hone-cli.jsView on unpkg · L25

7499const run = spawnSync(command, { L7500: cwd: wt, shell: true, encoding: 'utf8', L7501: timeout: Number(opts.timeout) * 1000, env: gitEnv(),

High

Shell

Package source references shell execution.

hone-cli.jsView on unpkg · L7499

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. hone-cli.js: baseURL: config.apiUrl, Authorization: `Bearer ${config.token}`, fs.writeFileSync(target, f.content); fs.writeFileSync(pipelineConfigPath, updated); fs.writeFileSync(configPath, result.augmentedConfig); write: (data) => fs.writeFileSync(path.join(agentsDir, `${agent}.agent.md`), data), fs.writeFileSync(path.join(skillDir, 'SKILL.md'), data); write: (data) => fs.writeFileSync(path.join(enterpriseGH, 'copilot-instructions.md'), data),

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

hone-cli.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. c.config.length + mc.test.length; console.log(` ${p}: ${total} metadata types, ${data.selecteddocs.length} doc urls, mcp: ${data.mcp.available ? 'available' : 'not detected'}`); } for (const w of (result.warnings || [])) console.log(` ⚠ ${w}`); } else { console.log(`ℹ refresh skipped: ${result.reason}`); } return; } console.log('hone ai — pipeline setup'); console.log('=============================='); console.log(''); let orgconfig; try { const r = await client.get('/scripts/config'); orgconfig = r.data; console.log(`org:

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

hone-cli.jsView on unpkg

1154L1155: const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D'; L1156: ... L1162: try { L1163: execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot }); L1164: console.log(` ✓ Unit test framework installed`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hone-cli.jsView on unpkg · L1154

bin/hone-mcp.jsView file

5// (or `hone-mcp` once installed). Delegates to ../mcp-server.js `start()`. L6: require('../mcp-server.js').start().catch((e) => { L7: process.stderr.write(`hone-mcp failed: ${e && e.message ? e.message : String(e)}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hone-mcp.jsView on unpkg · L5

lib/agent-eval-probes-boundary.jsView file

28contains invisible/control Unicode U+202E (right-to-left override) input: '<U+202E>abc� mixed with control chars',

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/agent-eval-probes-boundary.jsView on unpkg · L28

lib/hook-templates/pre-push.shView file

•path = lib/hook-templates/pre-push.sh kind = build_helper sizeBytes = 2812 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/hook-templates/pre-push.shView on unpkg

lib/doctor-architecture.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/doctor-architecture.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 3-43json

3 "version": "1.28.0",

4 "description": "Hone AI — Enterprise SDLC Pipeline CLI",

5 "main": "hone-cli.js",

6 "bin": {

7 "hone": "./bin/hone.js",

8 "hone-mcp": "./bin/hone-mcp.js"

9 },

10 "files": [

11 "bin/",

12 "hone-cli.js",

13 "lib/",

14 "!lib/*.test.js",

15 "schema/",

16 "mcp-server.js"

17 ],

18 "scripts": {

19 "test": "echo \"No tests yet\" && exit 0",

20 "link": "npm link",

21 "sync-server-cli-version": "node scripts/sync-server-cli-version.js",

22 "prepublishOnly": "node scripts/sync-server-cli-version.js",

23 "postinstall": "echo '\\n Hone AI CLI installed successfully.\\n Next: run `hone init --token <YOUR_TOKEN>` to configure.\\n Docs: https://github.com/subbareddyvani/hone-server\\n'"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "dependencies": {

26 "@modelcontextprotocol/sdk": "^1.30.0",

27 "ajv": "^8.20.0",

28 "axios": "^1.20.0",

29 "commander": "^11.0.0",

30 "js-yaml": "^4.3.2"

31 },

32 "engines": {

33 "node": ">=18.0.0"

34 },

35 "keywords": [

36 "hone",

37 "ai",

38 "sdlc",

39 "pipeline",

40 "enterprise",

41 "developer-tools"

42 ],

43 "author": "Hone AI",

hone-cli.jsView file

Lines 5-45javascript

5 *

6 * Bridges the gap between setup-ai-pipeline.sh v3.1 and the Hone server.

7 * The key insight: setup-ai-pipeline.sh needs ENTERPRISE_SOURCE = enterprise-github

bin/hone-mcp.jsView file

Lines 1-10javascript

1#!/usr/bin/env node

2'use strict';

3// HC-COMM-012 (A1 P1): entry point for the Hone MCP server (stdio).

4// Registered by the Claude Code plugin's .mcp.json as `npx -y @hone-ai/cli hone-mcp`

5// (or `hone-mcp` once installed). Delegates to ../mcp-server.js `start()`.

6require('../mcp-server.js').start().catch((e) => {

lib/agent-eval-probes-boundary.jsView file

Lines 8-32javascript

8 * the `json_or_refusal` grader encodes that contract.

9 */

10module.exports = [

11 {

12 id: 'boundary-empty-001',

13 input: '',

lib/hook-templates/pre-push.shView file

•path = lib/hook-templates/pre-push.sh kind = build_helper sizeBytes = 2812 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

lib/hook-templates/pre-push.shView on unpkg

lib/doctor-architecture.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/doctor-architecture.js#virtual:normalized:round1View on unpkg

Lines 1134-1174javascript

1134 const installE2e = opts && opts.e2e !== false && opts.noE2e !== true;

1135 if (installE2e) {

1136 console.log('');

1137 console.log(` Skipping Playwright (Python) e2e auto-install — adopters opt in via \`pip install pytest-playwright\` separately.`);

1138 console.log(` See pytest-playwright docs for details.`);

1139 }

1140}

1141

1142async function installTestFramework(repoRoot, opts) {

1143 console.log('');

1144 console.log('── Test Framework Setup ────────────────────────────────');

1145 console.log('');

1146

1147 const detected = detectExistingTestFramework(repoRoot);

1148 const pkgs = getInstallPackages(detected.stack);

1149

1150 // H-002b: Python branch — different install commands + pyproject.toml (not package.json)

1151 if (pkgs.pkgManagerKind === 'python') {

1152 return installPythonTestFramework(repoRoot, detected, pkgs, opts);

1153 }

1154

1155 const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D';

1156

1157 // ── Unit test framework ────────────────────────────────

1158 if (detected.testFw) {

1159 console.log(` Test framework detected: ${detected.testFw} ✓ (skipping install)`);

1160 } else {

1161 console.log(` Stack: ${detected.stack} → Installing: ${pkgs.unit.join(', ')}`);

1162 try {

1163 execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot });

1164 console.log(` ✓ Unit test framework installed`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hone-cli.jsView on unpkg · L1154

1165 } catch (e) {

1166 console.error(` ✗ Install failed: ${e.message}`);

1167 return;

1168 }

1169 }

1170

1171 // ── Test config file ───────────────────────────────────

1172 if (detected.hasTestConfig) {

1173 console.log(` Test config exists ✓ (skipping creation)`);

1174 } else {

Lines 7479-7519javascript

7479 applyDetail = (e.stderr || '').toString().split('\n').find(Boolean) || 'git apply failed';

7480 }

7481 if (!applied) {

7482 emit({ ok: false, verdict: 'does_not_apply', detail: applyDetail },

7483 `✗ diff did not apply in the worktree: ${applyDetail}`);

7484 exitCode = EXIT.DOES_NOT_APPLY;

7485 reportVerdict = 'does_not_apply'; reportDetail = applyDetail;

7486 } else {

7487 // 5. Run the adopter's test command in the worktree.

7488 // HC-COMM-010-followup-6: a bare worktree has no dependencies — provision it

7489 // (link the repo's node_modules when the lockfile is unchanged, else run the

7490 // lockfile's install, or ci.install_command). Fail-open; --no-provision opts out.

7491 if (opts.provision !== false) {

7492 const { planProvision, provisionWorktree } = require('./lib/worktree-provision');

7493 const { readCIConfigDetails } = require('./lib/pipeline-config');

7494 const plan = planProvision({ worktreeDir: wt, parentDir: process.cwd(), installCommand: readCIConfigDetails(process.cwd()).install_command });

7495 const prov = provisionWorktree(plan, { worktreeDir: wt, exec: spawnSync });

7496 if (opts.format !== 'json') console.log(` provisioning: ${prov.summary}`);

7497 }

7498 if (opts.format !== 'json') console.log(` running: ${command} (in isolated worktree, timeout ${opts.timeout}s)`);

7499 const run = spawnSync(command, {

7500 cwd: wt, shell: true, encoding: 'utf8',

7501 timeout: Number(opts.timeout) * 1000, env: gitEnv(),

High

Shell

Package source references shell execution.

hone-cli.jsView on unpkg · L7499

7502 stdio: ['ignore', 'pipe', 'pipe'],

7503 });

7504 const timedOut = run.error && run.error.code === 'ETIMEDOUT';

7505 const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr });

7506 const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'timeout' ? '⏱' : '✗';

7507 emit(

7508 { ok: v.verdict === 'pass', verdict: v.verdict, command, detail: v.detail },

7509 `${sym} ${v.detail}\n (command: ${command})`);

7510 exitCode = v.exitCode;

7511 reportVerdict = v.verdict; reportDetail = v.detail;

7512 }

7513 } catch (e) {

7514 emit({ ok: false, verdict: 'error', detail: e.message },

7515 `✗ verify-patch failed: ${e.message}`);

7516 exitCode = 1;

7517 reportVerdict = 'error'; reportDetail = e.message;

7518 } finally {

7519 cleanup();