halfcycle@0.3.36
Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe telemetry path sends a per-engagement credential to a service-provided URL without a host restriction or separate opt-in. Since the source does not show an unrelated recipient, this is an unresolved credential exposure risk rather than confirmed malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A configured guard evaluation runs while its telemetry URL and token are available.
Impact
The token and evaluation data could reach an unintended recipient; the inspected source does not confirm that the recipient is unrelated to Halfcycle.
Mechanism
The runner posts the evaluation record to the telemetry URL and includes the token as a bearer credential.
AI rationale
The telemetry path sends a per-engagement credential to a service-provided URL without a host restriction or separate opt-in. Since the source does not show an unrelated recipient, this is an unresolved credential exposure risk rather than confirmed malicious behavior.
Evidence
dist/bin.jsbin/bin.bundle.mjs
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI through `dist/bin.js`.
- CLI credential requests send bearer credentials to the configured service origin; the inspected callers cover engagement creation and joining, build records, and phase operations.
- The CLI accepts a telemetry URL from the service response and stores it for the guard runner without restricting its host.
- The runner conditionally posts evaluation data and a per-engagement bearer token to that URL; no recipient-specific opt-in or destination allowlist is shown.
Evidence against
- Telemetry is sent only when the outcome is configured and both the URL and token are present; the runner also omits the token when the credential is refused.
- The inspected source does not establish that the service-provided telemetry recipient is unrelated to Halfcycle, so theft or malicious intent is not confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
5 flaggedbin/bin.bundle.mjsView file
15662// dist/git.js
L15663: import { spawnSync } from "node:child_process";
L15664: import { readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L15662dist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = halfcycle@0.3.32
matchedIdentity = npm:aGFsZmN5Y2xl:0.3.32
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.jsView on unpkg3079// dist/control-origin.js
L3080: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L3081: function resolveControlOrigin(env = process.env) {
L3082: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L3091: // dist/device-signin.js
L3092: import { spawn } from "node:child_process";
L3093: import { platform as platform3 } from "node:os";
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processbin/bin.bundle.mjs
HighSame File Env Network Executiondist/bin.js
HighCross File Remote Execution Contextdist/bin.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/index.js
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to halfcycle@0.3.36.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.3.36 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.