registry / Install hook abuse / lithermes-ai
lithermes-ai
npx/bunx installer for the LitHermes Hermes plugin
This report shows the evidence for lithermes-ai@0.9.9. 1 of 18 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a concealed automatic self-update path from an AI-agent lifecycle hook to a newer release of itself, followed by control-surface mutation. Although it lacks an npm install hook and limits inherited environment variables, the complete hidden self-update chain is concrete and automatic.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An interactive first LLM call after the plugin has been installed, when a newer registry version exists.
Impact
A registry-selected newer package release gains automatic execution and can alter the Hermes agent control surface.
Mechanism
Hidden pre-LLM self-update through npx followed by plugin and config replacement.
Attack narrative
After installation, the auto-loaded plugin registers pre_llm_call. On a first interactive turn it queries the npm registry and runs npx against a newer exact lithermes-ai release through a private command hidden from normal help. The child installer removes the current plugin payload, copies its replacement, and writes Hermes configuration. This is an automatic runtime self-dependency chain that changes an AI-agent control surface without a fresh user action.
AI rationale
The package contains a concealed automatic self-update path from an AI-agent lifecycle hook to a newer release of itself, followed by control-surface mutation. Although it lacks an npm install hook and limits inherited environment variables, the complete hidden self-update chain is concrete and automatic.
Evidence
assets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/auto_update.pysrc/cli.jssrc/lib/install.js~/.hermes/plugins/lithermes~/.hermes/config.yaml~/.hermes/lithermes/install-manifest.json
Network endpoints1
registry.npmjs.org/lithermes-ai/latest
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The installed plugin registers a pre-LLM lifecycle hook, so update code runs during agent use.
- The hook fetches the latest version and silently invokes npx for a newer release of this same package.
- The private update command is deliberately omitted from help output.
- The invoked installer replaces the LitHermes plugin payload and writes Hermes configuration without a new user confirmation.
- The package contacts the npm registry as part of this automatic self-update chain.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle script.
- The update child process removes most inherited environment variables, limiting direct credential exposure.
- The shown update path requests an exact stable version and includes rollback checks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flagged · loading sourcebin/lithermes.jsView file
1#!/usr/bin/env node
L2: const { main } = require("../src/cli");
L3:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/lithermes.jsView on unpkg · L1assets/lithermes-plugin/litgoal/store.pyView file
•path = assets/lithermes-plugin/litgoal/store.py
kind = build_helper
sizeBytes = 14394
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
assets/lithermes-plugin/litgoal/store.pyView on unpkgassets/lithermes-plugin/vendor/045_scientific-visualization/tests/test_figure_export.pyView file
Findings
3 High5 Medium5 Low
HighPayload In Excluded Dirassets/lithermes-plugin/vendor/045_scientific-visualization/tests/test_figure_export.py
HighKnown Malware Source Similarityassets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.ts
HighPrevious Version Dangerous Deltasrc/lib/skins.js
MediumDynamic Requirebin/lithermes.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperassets/lithermes-plugin/litgoal/store.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to lithermes-ai@0.9.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing lithermes-ai@0.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.