halfcycle@0.4.1
Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected runtime credential flows send requests through Halfcycle service helpers. Scanner signals for networking, process execution, and agent configuration did not establish a concrete attack in the reviewed source.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI or imports the module; project configuration is applied through CLI setup.
Impact
No malicious effect was established by the reviewed credential flows or agent configuration paths.
Mechanism
Credential-bearing requests use the configured service URL, whose default control origin is the Halfcycle service. The inspected Claude settings and hook paths are project-local.
AI rationale
The manifest has no install lifecycle hook, and the inspected runtime credential flows send requests through Halfcycle service helpers. Scanner signals for networking, process execution, and agent configuration did not establish a concrete attack in the reviewed source.
Evidence
.claude/settings.json.claude/settings.local.json.halfcycle/bin/bin.bundle.mjs
Network endpoints1
control.halfcycle.ai
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and module entrypoint and defines build, typecheck, and test scripts; no install lifecycle script is present.
- The inspected request helpers send bearer credentials to URLs built from the service URL, and the default control origin is the Halfcycle service.
- Credential-bearing callers perform project setup, engagement joining, and phase operations through those service helpers.
- The inspected agent paths identify project-local Claude settings and hooks; the credential declaration describes values supplied to a local guard runner.
Evidence against
- The inspected source does not establish credential forwarding to an unrelated recipient or another concrete attack; the network and process use fits the service and project tooling.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedbin/bin.bundle.mjsView file
15712// dist/git.js
L15713: import { spawnSync } from "node:child_process";
L15714: import { readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L15712dist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = halfcycle@0.4.0
matchedIdentity = npm:aGFsZmN5Y2xl:0.4.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg3155// dist/control-origin.js
L3156: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L3157: function resolveControlOrigin(env = process.env) {
L3158: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L3167: // dist/device-signin.js
L3168: import { spawn } from "node:child_process";
L3169: import { platform as platform3 } from "node:os";
Findings
1 Critical7 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/bin.bundle.mjs
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to halfcycle@0.4.1.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.