@punks/cli@6.1.2
Harness Intelligence scaffolding CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports explicit CLI agent configuration mutation with automatically approved tools, which the supplied policy classifies as warning-only. The scanner's stronger malware claims were not substantiated by inspected behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Running hi init or hi update with the TypeScript runtime selected.
Impact
Codex gains automatically approved TypeScript inspection capabilities through installed runtime code; existing conflicting user servers are preserved.
Mechanism
The installer installs a pinned runtime with npm scripts disabled and writes a managed MCP server block whose selected read tools receive automatic approval. Later explicit updates refresh the managed configuration.
AI rationale
Inspected source supports explicit CLI agent configuration mutation with automatically approved tools, which the supplied policy classifies as warning-only. The scanner's stronger malware claims were not substantiated by inspected behavior.
Evidence
dist/index.js.codex/config.toml
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no npm install lifecycle hooks or runtime self-dependency.
- The explicit init command prompts for selection in interactive mode; other modes accept the proposal defaults.
- The installer synchronizes a TypeScript tool runtime and writes project-level .codex/config.toml.
- Generated MCP configuration enables selected TypeScript read tools with automatic approval.
- The runtime installation uses npm ci with lifecycle scripts disabled, and configuration merging avoids conflicting user-defined servers.
- The explicit update command reapplies installation using saved project settings without another selection prompt.
Evidence against
- No concrete credential theft, covert command-output export, or obfuscated executable payload was established from the inspected source.
- Agent configuration changes occur through CLI scaffolding operations, rather than npm installation hooks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVars
Source & flagged code
9 flaggeddist/index.jsView file
155`)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
High
349`);const preCommit=lines2.findIndex((line)=>line.trim()==="pre-commit:");if(preCommit===-1){return null}const preIndent=indent(lines2[preCommit]);const preCommitEnd=lines2.findInde...
L350: `).some((line)=>{const command=line.trim();return command.length>0&&!command.startsWith("#")&&(/^(?:(?:command|exec)\s+)?lefthook\s+run\s+["']?pre-commit["']?(?:\s|$)/u.test(comman...
L351:
High
151`)return yield*this.pushCount(1);else if(ch==="\r"&&this.charAt(1)===`
L152: `)return yield*this.pushCount(2);else return 0}*pushSpaces(allowTabs){let i=this.pos-1;let ch;do{ch=this.buffer[++i]}while(ch===" "||allowTabs&&ch==="\t");const n=i-this.pos;if(n>0...
L153: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
...
L155: `)+1;while(nl!==0){this.onNewLine(this.offset+nl);nl=this.source.indexOf(`
L156: `,nl)+1}}return{type,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(parent){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"do...
L157: `+ind(d+1));return`[
Findings
7 High6 Medium6 Low
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumDynamic Requiredist/index.js
MediumUnsafe Vm Contextdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
Affected versions and remediation
This report applies to @punks/cli@6.1.2.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@6.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.