registry / lithermes-ai / 0.8.27

lithermes-ai@0.8.27

npx/bunx installer for the LitHermes Hermes plugin

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 123 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com

Source & flagged code

3 flagged

bin/lithermes.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2const { main } = require("../src/cli");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

4main(process.argv.slice(2)).catch((error) => {

5 const code = Number.isInteger(error.exitCode) ? error.exitCode : 1;

6 console.error(error.message || String(error));

7 process.exit(code);

8});

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 3767 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

Source & flagged code

3 flagged · loading source

bin/lithermes.jsView file

1#!/usr/bin/env node L2: const { main } = require("../src/cli"); L3:

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code