Loading npm security reports…

hermes-to-claude: AI-agent policy block | LPM Firewall

registry / hermes-to-claude / 0.1.10

hermes-to-claude@0.1.10

Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. npm installation mutates the user-wide Claude Code configuration. The inserted status-line command executes package code during later Claude Code use and reads a saved user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall, then Claude Code status-line execution

Impact

Persists package-controlled execution in a broad AI-agent control surface and changes the user's existing configuration.

Mechanism

unconsented global Claude Code status-line takeover

Policy narrative

On npm installation, the postinstall script reads and replaces the global ~/.claude/settings.json statusLine entry with `node dist/statusline.mjs`. It stores any pre-existing status-line command in ~/.h2c_user_statusline_cmd; the installed statusline later executes that saved command and package code whenever Claude Code renders its status line. This is an unconsented postinstall mutation of a foreign, user-wide AI-agent control surface.

Rationale

Source inspection confirms concrete postinstall persistence in Claude Code's global settings, not merely scanner similarity. Although no external exfiltration was found, this behavior meets the firewall block boundary for unconsented postinstall AI-agent control-surface mutation.

Evidence

package.jsonscripts/setup-mcp.cjsdist/statusline.mjsdist/hbridge.mjsdocs/local-mode.md~/.claude/settings.json~/.h2c_user_statusline_cmd

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-mcp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/hbridge.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.9 matchedPath = dist/hbridge.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hbridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 71cbcea900553e17 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hermes-to-claude@0.1.9 matchedPath = dist/hbridge.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.9 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/hbridge.mjsView on unpkg

3// src/hbridge/server.mjs L4: import { createServer as http } from "http"; L5: ... L9: // src/hbridge/session.mjs L10: import { spawn } from "child_process"; L11: ... L143: try { L144: await this.config.send(batch); L145: success = true; ... L236: * @param {number} [opts.maxQueueSize=10000] - Max pending before backpressure L237: * @param {(err: Error) => void} [opts.onError] - Stderr parse error callback L238: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hbridge.mjsView on unpkg · L3

scripts/setup-mcp.cjsView file

6Install-time AI-agent control hijack evidence: L7: process.env.HOME || os.homedir(), L8: ".claude", L9: "settings.json", ... L12: process.env.HOME || os.homedir(), L13: ".claude", L14: "skills", ... L30: if (settings.statusLine?.command && settings.statusLine.command !== cmd) { L31: fs.mkdirSync(path.dirname(USER_CMD_FILE), { recursive: true }); L32: fs.writeFileSync(USER_CMD_FILE, settings.statusLine.command, "utf8"); L33: } ... L35: L36: fs.mkdirSync(path.dirname(USER_SETTINGS), { recursive: true }); Payload evidence from scripts/setup-mcp.cjs: L6: const USER_SETTINGS = path.join( L7: process.env.HOME || os.homedir(), L8: ".claude", ... L25: if (fs.existsSync(USER_SETTINGS)) { L26: settings = JSON.parse(fs.readFileSync(USER_SETTINGS, "utf8")); L27: }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/setup-mcp.cjsView on unpkg · L6

dist/statusline.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.9 matchedPath = dist/statusline.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/statusline.mjsView on unpkg

build.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.9 matchedPath = build.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 3-30json

3 "version": "0.1.10",

4 "type": "module",

5 "description": "Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required",

6 "license": "MIT",

7 "repository": "github:xuhancn/hermes-to-claude",

8 "bin": {

9 "h2c": "dist/hbridge.mjs"

10 },

11 "files": [

12 "dist/",

13 "scripts/",

14 "docs/",

15 "DESIGN.md",

16 "LICENSE",

17 "README.md",

18 "build.mjs"

19 ],

20 "scripts": {

21 "build": "node build.mjs",

22 "prepublishOnly": "npm run build",

23 "postinstall": "node scripts/setup-mcp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

24 "test": "node src/hbridge/transport/__tests__/run-all.mjs && node tests/test_bridge.mjs && node tests/test_e2e.mjs"

25 },

26 "devDependencies": {

27 "esbuild": "^0.25.0"

28 }

29}

30

dist/hbridge.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3// src/hbridge/server.mjs

4import { createServer as http } from "http";

5

6// src/hbridge/bridge.mjs

7import { randomUUID } from "crypto";

8

scripts/setup-mcp.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2const fs = require("fs");

3const path = require("path");

4const os

dist/statusline.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.9 matchedPath = dist/statusline.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/statusline.mjsView on unpkg

build.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.9 matchedPath = build.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build.mjsView on unpkg