registry / hermes-to-claude / 0.2.15

hermes-to-claude@0.2.15

⚠ Under review

Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 63.5 KB of source, external domains: 127.0.0.1, github.com

Source & flagged code

7 flagged

package.jsonView file

Lines 4-43json

4 "type": "module",

5 "description": "Local HTTP bridge connecting Hermes Agent to Claude Code — no Pro/Max subscription required",

6 "license": "MIT",

7 "repository": "github:xuhancn/hermes-to-claude",

8 "bin": {

9 "h2c": "dist/h2c.mjs"

10 },

11 "files": [

12 "dist/",

13 "scripts/",

14 "docs/",

15 "DESIGN.md",

16 "LICENSE",

17 "README.md",

18 "build.mjs"

19 ],

20 "scripts": {

21 "build": "node build.mjs",

22 "prepare": "npm run build",

23 "prepublishOnly": "npm run build",

24 "postinstall": "node scripts/setup-mcp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "test": "node src/hermes_to_claude/transport/__tests__/run-all.mjs && node tests/test_bridge.mjs && node tests/test_e2e.mjs"

26 },

27 "devDependencies": {

28 "esbuild": "^0.25.0"

29 },

30 "keywords": [

31 "hermes",

32 "claude",

33 "claude-code",

34 "h2c",

35 "agent",

36 "orchestrator",

37 "bridge",

38 "multi-agent",

39 "ai-agent",

40 "hermes-agent"

41 ]

42}

dist/h2c.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

3// src/hermes_to_claude/server.mjs

4import { createServer as http } from "http";

6// src/hermes_to_claude/bridge.mjs

7import { randomUUID } from "crypto";

dist/h2c.mjs#virtual:normalized:round1View file

669/** L670: * Handle a parsed NDJSON message from Claude"s stdout.\n * @param {Record<string,unknown>} msg\n */\n _onMessage(msg) {\n process.stderr.write(`[session:msg] ${this.taskId}... L671: const out = execFileSync(

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/h2c.mjs#virtual:normalized:round1View on unpkg · L669

scripts/setup-mcp.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2const fs = require("fs");

3const path = require("path");

4const os

Source & flagged code

7 flagged · loading source

package.jsonView file

•

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code