registry / @yancyyu/agentcli / 1.9.14

@yancyyu/agentcli@1.9.14

AgentCli: AI 工程协作平台，本地优先的用量采集与团队协作工具。

AI Security Review

scanned 2h ago · by lpm-firewall-ai

When the telemetry worker runs with configuration and an auth token, the package reads local AI-session messages and uploads their content to a hard-coded HTTP endpoint. Installation also writes package-owned workflow files beneath `~/.hermit`.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the CLI/server telemetry worker after installation; upload is default-on unless configuration opts out.

Impact

Private Claude Code/Codex conversation text, project metadata, and usage data can leave the machine over plaintext HTTP.

Mechanism

default-on collection and remote upload of AI conversation content

Attack narrative

The package's periodic telemetry path treats conversation upload as enabled by default. Once a usable local Bearer token exists, it collects Claude Code and Codex JSONL-derived message records, including message text and project/conversation metadata, then posts batches to a hard-coded IP address over HTTP. The install hook separately seeds marked workflows only inside the package's `~/.hermit` home, so that lifecycle write is not the blocking behavior.

Rationale

Concrete default-on remote transmission of local AI conversation content to a hard-coded plaintext endpoint is data exfiltration behavior. The install hook is package-scoped, but it does not mitigate the telemetry upload risk.

Evidence

bin/postinstall.mjssrc/main/services/session-intelligence/UsageTelemetryService.tssrc/main/services/session-intelligence/ConversationMessageUploadService.tssrc/main/telemetry/worker.tssrc/main/services/auth/OpenHermitAuthClient.ts~/.hermit/.claude/workflow/*~/.hermit/config.json~/.hermit/telemetry/conversation-message-upload.lock~/.hermit/telemetry/conversation-upload.log

Network endpoints2

159.75.231.98:8088/api/v1/report/messages159.75.231.98:8088/api/v1/auth/me

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

`src/main/services/session-intelligence/UsageTelemetryService.ts` enables conversation upload by default unless explicitly disabled.
`ConversationMessageUploadService.ts` scans and uploads full Claude Code/Codex message content, not only token totals.
Uploads default to `http://159.75.231.98:8088/api/v1/report/messages` using a Bearer token.
`src/main/telemetry/worker.ts` runs periodic telemetry scans that invoke the upload path.
`bin/postinstall.mjs` seeds and refreshes package workflows under `~/.hermit/.claude/workflow` during install.

Evidence against

Upload waits for a locally stored valid Bearer token; no upload is sent when absent.
`bin/postinstall.mjs` has no network calls and confines its writes to `~/.hermit`.
Workflow seeding preserves files without the package marker instead of overwriting them.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 1,123 file(s), 10.3 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.anthropic.com, api.dicebear.com, api.example.com, api.github.com, cdn.jsdelivr.net, chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, monitor.test, raw.githubusercontent.com, react.dev, redis.example.com, redis.lazymind.vip, registry.npmjs.org, tldrlegal.com, voicetext.site, www.w3.org, yancyuu.github.io, yancyyu.github.io

Oversized source lightweight scan

dist-renderer/assets/index-C1mZc0uS.js6.24 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsreact.dev

Source & flagged code

15 flagged

package.jsonView file

Lines 161-192json

161 "remark-gfm": "^4.0.1",

162 "remark-parse": "^11.0.0",

163 "shadcn": "^4.12.0",

164 "tailwind-merge": "^3.5.0",

165 "tailwindcss": "^3.4.1",

166 "tailwindcss-animate": "^1.0.7",

167 "typescript": "^5.9.3",

168 "typescript-eslint": "^8.54.0",

169 "unified": "^11.0.5",

170 "vite": "^5.4.2",

171 "vitest": "^3.1.4",

172 "yet-another-react-lightbox": "^3.29.1",

173 "zustand": "^4.5.0"

174 },

175 "scripts": {

176 "dev": "node ./scripts/dev-mvp.mjs",

177 "dev:server": "tsx watch src/main/server.ts",

178 "dev:web": "vite --config vite.web.config.ts",

179 "build:web": "vite build --config vite.web.config.ts --outDir ../../dist-renderer --emptyOutDir",

180 "build:pages": "node ./scripts/build-pages.mjs",

181 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L181

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L181

182 "start": "node bin/hermit.mjs",

183 "typecheck": "tsc --noEmit",

184 "lint": "eslint src/ --cache --cache-location .eslintcache --cache-strategy content",

185 "lint:fix": "eslint src/ --fix --cache --cache-location .eslintcache --cache-strategy content",

186 "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

187 "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

188 "test": "vitest run",

189 "test:watch": "vitest",

190 "test:coverage": "vitest run --coverage"

191 }

192}

bin/kill-dev.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

4const isWindows = process.platform === 'win32';

6if (isWindows) {

7 const r = spawnSync('taskkill', ['/F', '/IM', 'electron.exe'], {

8 stdio: 'inherit',

9 shell: true,

10 });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

11 if (r.status != null && r.status !== 0 && r.status !== 128 && r.signal == null) {

12 process.exitCode = 1;

13 }

14} else {

15 const r = spawnSync('pkill', ['-f', 'electron-vite|electron \\.'], { stdio: 'inherit' });

16 if (r.status != null && r.status !== 0 && r.status !== 1 && r.signal == null) {

17 process.exitCode = 1;

18 }

19}

20console.log('Done');

bin/lib/navigationCommand.mjsView file

Lines 113-153javascript

113 TASK_BUS_ACTIONS,

114 ACCOUNT_ACTIONS,

115 findMenuAction,

116} from './menus.mjs';

117import {

118 printDeveloperUploadLogs,

119 readLogTail,

120} from './runtime.mjs';

121import {

122 waitForOpenHermitServerReady,

123} from './daemon.mjs';

124import {

125 safeReadJson,

126} from './settings.mjs';

127import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync, statSync, readSync } from 'node:fs';

128import { spawn, execSync } from 'node:child_process';

129import os from 'node:os';

130import { fileURLToPath } from 'node:url';

131

132// --- Busy screen message for inline actions ------------------------------------

133

134const require = createRequire(import.meta.url);

135

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L133

136function renderTerminalQr(value) {

137 try {

138 const qrcode = require('qrcode-terminal');

139 qrcode.generate(value, { small: true });

140 return true;

141 } catch {

142 return false;

143 }

144}

145

146const ONLINE_GUIDE_URL = 'https://yancyuu.github.io/agentcli/';

147const ONLINE_GUIDE_HANDOFF = [

148 `请先阅读 AgentCli 在线说明书：${ONLINE_GUIDE_URL}`,

149 '这是本机 AgentCli/Hermit 的使用手册。',

150 '后续回答和操作请以这份说明书为准。',

151];

152

153export function onlineGuideRows() {

bin/lib/teams.mjsView file

Lines 50-90javascript

50 'codex',

51 'cursor',

52 'gemini',

53 'iflow',

54 'kimi',

55 'devin',

56 'opencode',

57 'qoder',

58 'pi',

59 'acp',

60 'tmux',

61];

64function isValidBindProject(value) {

65 return typeof value === 'string' && /^[a-z0-9][a-z0-9_-]*$/.test(value);

66}

68function normalizeWorkDir(value) {

69 const raw = String(value || '').trim().replace(/^～/, '~');

70 if (!raw) return '';

71 if (raw === '~') return os.homedir();

72 if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

73 return path.resolve(raw);

74}

76function generateBindProject(displayName) {

77 const normalized = String(displayName || '')

78 .trim()

79 .toLowerCase()

80 .replace(/[^a-z0-9_-]+/g, '-')

81 .replace(/^-+|-+$/g, '')

82 .replace(/-{2,}/g, '-');

83 if (isValidBindProject(normalized)) return normalized;

84 const hash = crypto.createHash('sha1').update(String(displayName || 'team')).digest('hex').slice(0, 8);

85 return `team-${hash}`;

86}

88function isHiddenTeam(manifest) {

89 const slug = String(manifest?.slug || '');

90 const bindProject = String(manifest?.bindProject || '');

bin/lib/usageCommand.mjsView file

Lines 45-85javascript

45import {

46 currentFeatureStates,

47} from './featureState.mjs';

48import {

49 readHermitSettings,

50 writeHermitSettings,

51 safeReadJson,

52} from './settings.mjs';

53import {

54 resolveConversationUploadBaseUrl,

55 refreshOpenHermitAuthStatus,

56 readOpenHermitAuthStatus,

57} from './auth.mjs';

58import { BRAND, brandLogPrefix } from '../branding.mjs';

59import {

60 checkExistingOpenHermitServer,

61} from './runtime.mjs';

62import {

63 findAnyOptionValues,

64} from './env.mjs';

65import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync, statSync } from 'node:fs';

66import { spawn, execSync } from 'node:child_process';

67import os from 'node:os';

68import path from 'node:path';

69import { fileURLToPath } from 'node:url';

71// --- Progress/display helpers (used internally) -------------------------------

73function fitProgressLine(text) {

74 const columns = Math.max(40, Number(process.stdout.columns || 80));

75 const maxWidth = Math.max(20, columns - 2);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/usageCommand.mjsView on unpkg · L65

76 if (displayWidth(text) <= maxWidth) return text;

77 let result = '';

78 for (const char of text) {

79 if (displayWidth(`${result}${char}…`) > maxWidth) break;

80 result += char;

81 }

82 return `${result}…`;

83}

85// --- Shared status structures -------------------------------------------------

bin/lib/auth.mjsView file

Lines 347-387javascript

347function randomOAuthValue(bytes = 32) {

348 return base64Url(crypto.randomBytes(bytes));

349}

350

351function buildCodeChallenge(verifier) {

352 return base64Url(crypto.createHash('sha256').update(verifier).digest());

353}

354

355function buildAuthorizationUrl(config, redirectUri, state, codeChallenge) {

356 const url = new URL(config.authorizeUrl);

357 url.searchParams.set('response_type', 'code');

358 url.searchParams.set('client_id', config.clientId);

359 url.searchParams.set('redirect_uri', redirectUri);

360 url.searchParams.set('scope', config.scope);

361 url.searchParams.set('state', state);

362 url.searchParams.set('code_challenge', codeChallenge);

363 url.searchParams.set('code_challenge_method', 'S256');

364 return url.toString();

365}

366

367async function openExternalUrl(url) {

368 const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER;

369 if (mode === '0') return { opened: false, skipped: true };

370 if (mode === 'fetch') {

371 await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) });

372 return { opened: true, mode: 'fetch' };

373 }

374

375 const platform = process.platform;

376 // explorer.exe opens the URL in the default browser and takes the whole URL

377 // as a single argument, so query characters (& ? =) need no shell quoting.

378 // The previous powershell `Start-Process -FilePath $args[0]` form exited

379 // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L367

380 const command = platform === 'darwin' ? 'open' : platform === 'win32' ? 'explorer.exe' : 'xdg-open';

381 const commandArgsForPlatform = [url];

382

383 return new Promise((resolve) => {

384 let settled = false;

385 const settle = (result) => {

386 if (settled) return;

387 settled = true;

bin/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L3: import { L4: copyFileSync, L5: cpSync, L6: existsSync, L7: mkdirSync, L8: readFileSync, ... L11: rmSync, L12: writeFileSync, L13: } from 'node:fs'; ... L46: const bundledWorkflowsDir = path.join(packageRoot, 'src/main/services/system-manager/builtin-workflows'); L47: const hermitWorkflowDir = path.join(hermitHome, '.claude', 'workflow'); L48: const builtinWorkflowMarker = ''; Payload evidence from src/renderer/features/CLAUDE.md: L1: # Renderer Features - Legacy Note L2:

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

88try { L89: exec(`npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`, { L90: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L88

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-C1mZc0uS.jsView file

•path = dist-renderer/assets/index-C1mZc0uS.js kind = oversized_source_file sizeBytes = 6543246 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-renderer/assets/index-C1mZc0uS.jsView on unpkg

bin/hermit.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yancyyu/agentcli@1.9.12 matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.12 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/hermit.mjsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/kill-dev.jsView file

1#!/usr/bin/env node L2: import { spawnSync } from 'child_process'; L3:

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

8stdio: 'inherit', L9: shell: true, L10: });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

bin/lib/navigationCommand.mjsView file

133L134: const require = createRequire(import.meta.url); L135:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L133

bin/lib/teams.mjsView file

70if (!raw) return ''; L71: if (raw === '~') return os.homedir(); L72: if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

bin/lib/usageCommand.mjsView file

65import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync, statSync } from 'node:fs'; L66: import { spawn, execSync } from 'node:child_process'; L67: import os from 'node:os'; ... L73: function fitProgressLine(text) { L74: const columns = Math.max(40, Number(process.stdout.columns || 80)); L75: const maxWidth = Math.max(20, columns - 2); ... L112: running: Boolean(server?.running), L113: url: server?.url || `http://127.0.0.1:${port}`, L114: version: server?.version || '', ... L263: return lines.flatMap((line) => { L264: try { return [JSON.parse(line)]; } catch { return []; } L265: });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/usageCommand.mjsView on unpkg · L65

bin/lib/auth.mjsView file

367async function openExternalUrl(url) { L368: const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER; L369: if (mode === '0') return { opened: false, skipped: true }; L370: if (mode === 'fetch') { L371: await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) }); L372: return { opened: true, mode: 'fetch' }; ... L377: // as a single argument, so query characters (& ? =) need no shell quoting. L378: // The previous powershell `Start-Process -FilePath $args[0]` form exited L379: // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L367

bin/postinstall.mjsView file

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

88try { L89: exec(`npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`, { L90: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L88

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-C1mZc0uS.jsView file

•path = dist-renderer/assets/index-C1mZc0uS.js kind = oversized_source_file sizeBytes = 6543246 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-renderer/assets/index-C1mZc0uS.jsView on unpkg

bin/hermit.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/hermit.mjsView on unpkg

Findings

2 Critical7 High7 Medium7 Low

CriticalAi Agent Control Hijackbin/postinstall.mjs

CriticalPrevious Version Dangerous Deltabin/hermit.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/kill-dev.js

HighShellbin/kill-dev.js

HighSame File Env Network Executionbin/lib/auth.mjs

HighRuntime Package Installbin/lib/update.mjs

HighShips High Entropy Blobdist-renderer/icon.rar

HighOversized Source Filedist-renderer/assets/index-C1mZc0uS.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/lib/navigationCommand.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/lib/usageCommand.mjs

MediumShips Compressed Blobdist-renderer/icon.rar

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptobin/lib/teams.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiondist-renderer/icon.rar

LowCopyleft License

Source & flagged code

15 flagged

package.jsonView file

Lines 161-192json

161 "remark-gfm": "^4.0.1",

162 "remark-parse": "^11.0.0",

163 "shadcn": "^4.12.0",

164 "tailwind-merge": "^3.5.0",

165 "tailwindcss": "^3.4.1",

166 "tailwindcss-animate": "^1.0.7",

167 "typescript": "^5.9.3",

168 "typescript-eslint": "^8.54.0",

169 "unified": "^11.0.5",

170 "vite": "^5.4.2",

171 "vitest": "^3.1.4",

172 "yet-another-react-lightbox": "^3.29.1",

173 "zustand": "^4.5.0"

174 },

175 "scripts": {

176 "dev": "node ./scripts/dev-mvp.mjs",

177 "dev:server": "tsx watch src/main/server.ts",

178 "dev:web": "vite --config vite.web.config.ts",

179 "build:web": "vite build --config vite.web.config.ts --outDir ../../dist-renderer --emptyOutDir",

180 "build:pages": "node ./scripts/build-pages.mjs",

181 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L181

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L181

182 "start": "node bin/hermit.mjs",

183 "typecheck": "tsc --noEmit",

184 "lint": "eslint src/ --cache --cache-location .eslintcache --cache-strategy content",

185 "lint:fix": "eslint src/ --fix --cache --cache-location .eslintcache --cache-strategy content",

186 "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

187 "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css}\"",

188 "test": "vitest run",

189 "test:watch": "vitest",

190 "test:coverage": "vitest run --coverage"

191 }

192}

bin/kill-dev.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from 'child_process';

High

Child Process

Package source references child process execution.

bin/kill-dev.jsView on unpkg · L1

4const isWindows = process.platform === 'win32';

6if (isWindows) {

7 const r = spawnSync('taskkill', ['/F', '/IM', 'electron.exe'], {

8 stdio: 'inherit',

9 shell: true,

10 });

High

Shell

Package source references shell execution.

bin/kill-dev.jsView on unpkg · L8

11 if (r.status != null && r.status !== 0 && r.status !== 128 && r.signal == null) {

12 process.exitCode = 1;

13 }

14} else {

15 const r = spawnSync('pkill', ['-f', 'electron-vite|electron \\.'], { stdio: 'inherit' });

16 if (r.status != null && r.status !== 0 && r.status !== 1 && r.signal == null) {

17 process.exitCode = 1;

18 }

19}

20console.log('Done');

bin/lib/navigationCommand.mjsView file

Lines 113-153javascript

113 TASK_BUS_ACTIONS,

114 ACCOUNT_ACTIONS,

115 findMenuAction,

116} from './menus.mjs';

117import {

118 printDeveloperUploadLogs,

119 readLogTail,

120} from './runtime.mjs';

121import {

122 waitForOpenHermitServerReady,

123} from './daemon.mjs';

124import {

125 safeReadJson,

126} from './settings.mjs';

127import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync, statSync, readSync } from 'node:fs';

128import { spawn, execSync } from 'node:child_process';

129import os from 'node:os';

130import { fileURLToPath } from 'node:url';

131

132// --- Busy screen message for inline actions ------------------------------------

133

134const require = createRequire(import.meta.url);

135

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lib/navigationCommand.mjsView on unpkg · L133

136function renderTerminalQr(value) {

137 try {

138 const qrcode = require('qrcode-terminal');

139 qrcode.generate(value, { small: true });

140 return true;

141 } catch {

142 return false;

143 }

144}

145

146const ONLINE_GUIDE_URL = 'https://yancyuu.github.io/agentcli/';

147const ONLINE_GUIDE_HANDOFF = [

148 `请先阅读 AgentCli 在线说明书：${ONLINE_GUIDE_URL}`,

149 '这是本机 AgentCli/Hermit 的使用手册。',

150 '后续回答和操作请以这份说明书为准。',

151];

152

153export function onlineGuideRows() {

bin/lib/teams.mjsView file

Lines 50-90javascript

50 'codex',

51 'cursor',

52 'gemini',

53 'iflow',

54 'kimi',

55 'devin',

56 'opencode',

57 'qoder',

58 'pi',

59 'acp',

60 'tmux',

61];

64function isValidBindProject(value) {

65 return typeof value === 'string' && /^[a-z0-9][a-z0-9_-]*$/.test(value);

66}

68function normalizeWorkDir(value) {

69 const raw = String(value || '').trim().replace(/^～/, '~');

70 if (!raw) return '';

71 if (raw === '~') return os.homedir();

72 if (raw.startsWith('~/')) return path.join(os.homedir(), raw.slice(2));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/lib/teams.mjsView on unpkg · L70

73 return path.resolve(raw);

74}

76function generateBindProject(displayName) {

77 const normalized = String(displayName || '')

78 .trim()

79 .toLowerCase()

80 .replace(/[^a-z0-9_-]+/g, '-')

81 .replace(/^-+|-+$/g, '')

82 .replace(/-{2,}/g, '-');

83 if (isValidBindProject(normalized)) return normalized;

84 const hash = crypto.createHash('sha1').update(String(displayName || 'team')).digest('hex').slice(0, 8);

85 return `team-${hash}`;

86}

88function isHiddenTeam(manifest) {

89 const slug = String(manifest?.slug || '');

90 const bindProject = String(manifest?.bindProject || '');

bin/lib/usageCommand.mjsView file

Lines 45-85javascript

45import {

46 currentFeatureStates,

47} from './featureState.mjs';

48import {

49 readHermitSettings,

50 writeHermitSettings,

51 safeReadJson,

52} from './settings.mjs';

53import {

54 resolveConversationUploadBaseUrl,

55 refreshOpenHermitAuthStatus,

56 readOpenHermitAuthStatus,

57} from './auth.mjs';

58import { BRAND, brandLogPrefix } from '../branding.mjs';

59import {

60 checkExistingOpenHermitServer,

61} from './runtime.mjs';

62import {

63 findAnyOptionValues,

64} from './env.mjs';

65import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync, statSync } from 'node:fs';

66import { spawn, execSync } from 'node:child_process';

67import os from 'node:os';

68import path from 'node:path';

69import { fileURLToPath } from 'node:url';

71// --- Progress/display helpers (used internally) -------------------------------

73function fitProgressLine(text) {

74 const columns = Math.max(40, Number(process.stdout.columns || 80));

75 const maxWidth = Math.max(20, columns - 2);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/lib/usageCommand.mjsView on unpkg · L65

76 if (displayWidth(text) <= maxWidth) return text;

77 let result = '';

78 for (const char of text) {

79 if (displayWidth(`${result}${char}…`) > maxWidth) break;

80 result += char;

81 }

82 return `${result}…`;

83}

85// --- Shared status structures -------------------------------------------------

bin/lib/auth.mjsView file

Lines 347-387javascript

347function randomOAuthValue(bytes = 32) {

348 return base64Url(crypto.randomBytes(bytes));

349}

350

351function buildCodeChallenge(verifier) {

352 return base64Url(crypto.createHash('sha256').update(verifier).digest());

353}

354

355function buildAuthorizationUrl(config, redirectUri, state, codeChallenge) {

356 const url = new URL(config.authorizeUrl);

357 url.searchParams.set('response_type', 'code');

358 url.searchParams.set('client_id', config.clientId);

359 url.searchParams.set('redirect_uri', redirectUri);

360 url.searchParams.set('scope', config.scope);

361 url.searchParams.set('state', state);

362 url.searchParams.set('code_challenge', codeChallenge);

363 url.searchParams.set('code_challenge_method', 'S256');

364 return url.toString();

365}

366

367async function openExternalUrl(url) {

368 const mode = process.env.OPENHERMIT_AUTH_OPEN_BROWSER || process.env.OPENHERMIT_OAUTH_OPEN_BROWSER;

369 if (mode === '0') return { opened: false, skipped: true };

370 if (mode === 'fetch') {

371 await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(30_000) });

372 return { opened: true, mode: 'fetch' };

373 }

374

375 const platform = process.platform;

376 // explorer.exe opens the URL in the default browser and takes the whole URL

377 // as a single argument, so query characters (& ? =) need no shell quoting.

378 // The previous powershell `Start-Process -FilePath $args[0]` form exited

379 // non-zero and the browser silently never opened on Windows.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/lib/auth.mjsView on unpkg · L367

380 const command = platform === 'darwin' ? 'open' : platform === 'win32' ? 'explorer.exe' : 'xdg-open';

381 const commandArgsForPlatform = [url];

382

383 return new Promise((resolve) => {

384 let settled = false;

385 const settle = (result) => {

386 if (settled) return;

387 settled = true;

bin/postinstall.mjsView file

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

bin/postinstall.mjsView on unpkg · L1

bin/lib/update.mjsView file

88try { L89: exec(`npm install -g ${BRAND.npmPackage}@latest --registry=https://registry.npmjs.org/`, { L90: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/lib/update.mjsView on unpkg · L88

dist-renderer/icon.rarView file

•path = dist-renderer/icon.rar kind = high_entropy_blob sizeBytes = 85506 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = compressed_blob sizeBytes = 85506 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-renderer/icon.rarView on unpkg

•path = dist-renderer/icon.rar kind = nested_archive_needs_inspection sizeBytes = 85506 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist-renderer/icon.rarView on unpkg

dist-renderer/assets/index-C1mZc0uS.jsView file

•path = dist-renderer/assets/index-C1mZc0uS.js kind = oversized_source_file sizeBytes = 6543246 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-renderer/assets/index-C1mZc0uS.jsView on unpkg

bin/hermit.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/hermit.mjsView on unpkg