Loading npm security reports…

hermes-to-claude@0.1.2: AI-agent policy block | LPM Firewall

registry / hermes-to-claude / 0.1.2

hermes-to-claude@0.1.2

Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Automatic installation mutates the user's global Claude Code configuration. It replaces the existing status-line command with a package-controlled executable that runs whenever Claude Code renders its status line.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Executes package-controlled code through the user's Claude Code configuration without consent.

Mechanism

global Claude Code statusLine hijack and persistence

Policy narrative

Installing the package automatically runs `scripts/setup-mcp.cjs`, which edits the user's global `~/.claude/settings.json` and replaces its `statusLine.command` with `node <package>/dist/statusline.mjs`. This creates an unconsented Claude Code control-surface execution path. The installer also saves the prior command, and the replacement status-line program subsequently executes that command while adding its own behavior.

Rationale

This is a concrete, unconsented `postinstall` mutation of a foreign AI-agent control surface. The lack of remote exfiltration does not remove the automatic persistent configuration hijack.

Evidence

package.jsonscripts/setup-mcp.cjsdist/statusline.mjsdist/hbridge.mjs~/.claude/settings.json~/.h2c_user_statusline_cmd

Network endpoints1

/health

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-mcp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/hbridge.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.0 matchedPath = dist/hbridge.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hbridge.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 71cbcea900553e17 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hermes-to-claude@0.1.0 matchedPath = dist/hbridge.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/hbridge.mjsView on unpkg

3// src/hbridge/server.mjs L4: import { createServer as http } from "http"; L5: ... L9: // src/hbridge/session.mjs L10: import { spawn } from "child_process"; L11: ... L143: try { L144: await this.config.send(batch); L145: success = true; ... L236: * @param {number} [opts.maxQueueSize=10000] - Max pending before backpressure L237: * @param {(err: Error) => void} [opts.onError] - Stderr parse error callback L238: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hbridge.mjsView on unpkg · L3

scripts/setup-mcp.cjsView file

6Install-time AI-agent control hijack evidence: L7: process.env.HOME || os.homedir(), L8: ".claude", L9: "settings.json", ... L12: process.env.HOME || os.homedir(), L13: ".claude", L14: "skills", ... L30: if (settings.statusLine?.command && settings.statusLine.command !== cmd) { L31: fs.mkdirSync(path.dirname(USER_CMD_FILE), { recursive: true }); L32: fs.writeFileSync(USER_CMD_FILE, settings.statusLine.command, "utf8"); L33: } ... L35: L36: fs.mkdirSync(path.dirname(USER_SETTINGS), { recursive: true }); Payload evidence from scripts/setup-mcp.cjs: L6: const USER_SETTINGS = path.join( L7: process.env.HOME || os.homedir(), L8: ".claude", ... L25: if (fs.existsSync(USER_SETTINGS)) { L26: settings = JSON.parse(fs.readFileSync(USER_SETTINGS, "utf8")); L27: }

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/setup-mcp.cjsView on unpkg · L6

dist/statusline.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.0 matchedPath = dist/statusline.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/statusline.mjsView on unpkg

build.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.0 matchedPath = build.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 3-30json

3 "version": "0.1.2",

4 "type": "module",

5 "description": "Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required",

6 "license": "MIT",

7 "repository": "github:xuhancn/hermes-to-claude",

8 "bin": {

9 "h2c": "dist/hbridge.mjs"

10 },

11 "files": [

12 "dist/",

13 "scripts/",

14 "docs/",

15 "DESIGN.md",

16 "LICENSE",

17 "README.md",

18 "build.mjs"

19 ],

20 "scripts": {

21 "build": "node build.mjs",

22 "prepublishOnly": "npm run build",

23 "postinstall": "node scripts/setup-mcp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

24 "test": "node src/hbridge/transport/__tests__/run-all.mjs && node tests/test_bridge.mjs && node tests/test_e2e.mjs"

25 },

26 "devDependencies": {

27 "esbuild": "^0.25.0"

28 }

29}

30

dist/hbridge.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3// src/hbridge/server.mjs

4import { createServer as http } from "http";

5

6// src/hbridge/bridge.mjs

7import { randomUUID } from "crypto";

8

scripts/setup-mcp.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2const fs = require("fs");

3const path = require("path");

4const os

dist/statusline.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.0 matchedPath = dist/statusline.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/statusline.mjsView on unpkg

build.mjsView file

•matchType = normalized_sha256 matchedPackage = hermes-to-claude@0.1.0 matchedPath = build.mjs matchedIdentity = npm:aGVybWVzLXRvLWNsYXVkZQ:0.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

build.mjsView on unpkg