registry / AI-agent control-surface risk / @tokenharbor/halyard

@tokenharbor/halyard

Halyard — an agent harness wired to Token Harbor. Built on DeepSeek Harness.

This report shows the evidence for @tokenharbor/halyard@0.2.6. 4 of 7 known versions are blocked or flagged. The newest version, 0.2.11, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The concrete postinstall rewrite of a foreign AI-agent dependency is sufficient for blocking under the install-control-surface policy. The observed gateway credential use does not independently establish exfiltration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of this package

Impact

Alters the upstream agent control surface and obscures its origin.

Mechanism

postinstall rewrite of foreign AI-agent dependency assets

Policy narrative

Installation automatically runs a script that traverses installed @deepseek-ai packages, rewrites product-name strings, replaces the upstream web UI favicon, and injects CSS branding. This is an unconsented postinstall mutation of a foreign AI-agent interface, concealing the upstream product identity.

AI rationale

Evidence

package.jsonbin/rebrand.mjsnode_modules/@deepseek-ai/*/libnode_modules/@deepseek-ai/*/distnode_modules/@deepseek-ai/dsh-web-frontend/dist/favicon.svgnode_modules/@deepseek-ai/dsh-web-frontend/dist/index.html

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

Install lifecycle runs a rebranding script.
That script rewrites files in the foreign @deepseek-ai dependency tree.
It replaces the upstream web UI favicon and injects branding CSS.

Evidence against

No covert credential harvesting found; API key use is for the declared Token Harbor gateway.
Network authentication is invoked through explicit CLI login/debug paths.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 47.2 KB of source, external domains: 127.0.0.1, registry.npmjs.org, tokenharbor.ai

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node bin/rebrand.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/rebrand.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/halyard.mjsView file

7// layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/halyard.mjsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> bin/halyard.mjs L7: // layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/halyard.mjsView on unpkg · L7

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/halyard.mjsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> bin/halyard.mjs L7: // layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

bin/halyard.mjsView on unpkg · L7

bin/auth.mjsView file

•matchType = normalized_sha256 matchedPackage = @tokenharbor/halyard@0.2.5 matchedPath = bin/auth.mjs matchedIdentity = npm:QHRva2VuaGFyYm9yL2hhbHlhcmQ:0.2.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/auth.mjsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/rebrand.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/rebrand.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/halyard.mjsView file

Findings

2 Critical4 High4 Medium3 Low

CriticalCredential Exfiltrationbin/halyard.mjs

CriticalTrigger Reachable Dangerous Capabilitybin/halyard.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitybin/halyard.mjs

HighTrigger Reachable Credential Exfiltrationbin/halyard.mjs

HighKnown Malware Source Similaritybin/auth.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @tokenharbor/halyard@0.2.6.

The versions list below shows the verdict for each recorded version.

Avoid installing @tokenharbor/halyard@0.2.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-14 16:56:35.473Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

0.2.11latestClean—AllowPublishedAug 15, 2026, 9:47 AM 0.2.6shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 4:46 PM 0.2.5MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 14, 2026, 3:59 PM 0.2.4MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code