halfcycle@0.3.37
Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe static hints point to command execution and outbound requests, but the inspected source did not establish command-output exfiltration. The concrete concern is explicit CLI setup that modifies Claude Code project configuration, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the halfcycle CLI in install mode or supplies a project path.
Impact
This changes the project’s Claude Code configuration and adds package-provided hook behavior; no concrete malicious action was established in the inspected setup path.
Mechanism
The CLI writes generated hook files and merges generated settings into .claude/settings.json.
AI rationale
The static hints point to command execution and outbound requests, but the inspected source did not establish command-output exfiltration. The concrete concern is explicit CLI setup that modifies Claude Code project configuration, so a warning is appropriate.
Evidence
dist/bin.js.claude/settings.json.claude/hooks/guard-runner.sh.claude/hooks/session-start-marker.sh.claude/hooks/user-prompt-reminder.sh.claude/hooks/session-end-marker.sh
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI’s install flow writes or merges Claude Code settings and generated hooks into the selected project.
- The setup flow is activated by invoking the CLI with install, a project path, or no command.
- The package manifest has no preinstall, install, or postinstall hook.
- Source identifies the Claude settings file and vendored hook runner as integration targets.
Evidence against
- The package has no npm install lifecycle hook, so project configuration changes are not triggered merely by installing the package.
- The inspected setup behavior is in the explicit CLI project-install flow; no concrete credential theft or other active attack was established.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedbin/bin.bundle.mjsView file
15701// dist/git.js
L15702: import { spawnSync } from "node:child_process";
L15703: import { readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L15701dist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = halfcycle@0.3.32
matchedIdentity = npm:aGFsZmN5Y2xl:0.3.32
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.jsView on unpkg3055// dist/control-origin.js
L3056: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L3057: function resolveControlOrigin(env = process.env) {
L3058: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L3067: // dist/device-signin.js
L3068: import { spawn } from "node:child_process";
L3069: import { platform as platform3 } from "node:os";
Findings
1 Critical5 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processbin/bin.bundle.mjs
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
HighCross File Remote Execution Contextdist/bin.js
HighTrigger Reachable Command Output Exfiltrationdist/bin.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to halfcycle@0.3.37.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.3.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.