Loading npm security reports…

@tokenharbor/halyard@0.2.4: AI-agent control-surface risk | LPM Firewall

registry / @tokenharbor/halyard / 0.2.4

@tokenharbor/halyard@0.2.4

Halyard — an agent harness wired to Token Harbor. Built on DeepSeek Harness.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates the installed DeepSeek Harness UI and branding without a user command. Runtime configuration redirects the harness to Token Harbor and disables upstream provider plugins.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall; later execution of halyard

Impact

The installed AI harness is visually and operationally altered, obscuring its upstream identity and steering users to the package vendor's service.

Mechanism

postinstall dependency rebranding and agent-provider takeover

Policy narrative

On npm installation, the package runs a script that traverses installed @deepseek-ai dependency lib/dist trees and overwrites matching UI text, replaces the frontend favicon, and injects CSS to hide upstream branding. Its runtime overlay sets Token Harbor as the default model provider and disables upstream provider plugins, creating an unconsented takeover of a foreign AI-agent harness rather than a self-contained wrapper.

Rationale

This is concrete install-time mutation of a foreign AI-agent control surface, coupled with routing users to the package vendor's provider. The authentication network traffic is package-aligned but does not mitigate the install-time takeover.

Evidence

package.jsonbin/rebrand.mjsprofile/halyard.patch.ymlbin/auth.mjsnode_modules/@deepseek-ai/dsh-web-frontend/dist/favicon.svg

Network endpoints2

/v1

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/rebrand.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/rebrand.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/halyard.mjsView file

7// layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/halyard.mjsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> bin/halyard.mjs L7: // layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/halyard.mjsView on unpkg · L7

7// layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/halyard.mjsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> bin/halyard.mjs L7: // layer. Upgrading Halyard to a new DeepSeek Harness is a version bump in L8: // package.json, with no merge to perform, because we never edited their tree. L9: // ... L13: L14: import { spawn } from "node:child_process"; L15: import { existsSync, readFileSync } from "node:fs"; ... L48: L49: process.env.DSH_HOME ||= join(homedir(), ".halyard"); L50: const dshHome = process.env.DSH_HOME; ... L97: // reporting a bug would have quoted the wrong number. L98: const ownVersion = JSON.parse( L99: readFileSync(join(pkgRoot, "package.json"), "utf8"),

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

bin/halyard.mjsView on unpkg · L7

bin/auth.mjsView file

•matchType = normalized_sha256 matchedPackage = @tokenharbor/halyard@0.2.0 matchedPath = bin/auth.mjs matchedIdentity = npm:QHRva2VuaGFyYm9yL2hhbHlhcmQ:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/auth.mjsView on unpkg