registry / lithermes-ai / 0.8.28

lithermes-ai@0.8.28

npx/bunx installer for the LitHermes Hermes plugin

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit installation sets up a first-party LitHermes extension and edits the target Hermes configuration. When a Hermes repository is detected, the installer may patch selected Hermes source files for plugin dispatch compatibility.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `lithermes install --yes` (or equivalent bin command).

Impact

Changes a local AI-agent platform's enabled plugins and, when applicable, its command/gateway dispatch behavior.

Mechanism

Copies a bundled AI-agent plugin, enables it in Hermes config, and conditionally patches Hermes runtime sources.

Rationale

No concrete exfiltration, remote execution, stealth persistence, or unconsented npm lifecycle mutation was found. The package nevertheless performs explicit-user-command AI-agent extension setup and conditional host-source patching.

Evidence

package.jsonsrc/lib/install.jssrc/lib/config.jssrc/lib/patch.jsassets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/core.pyassets/lithermes-plugin~/.hermes/plugins/lithermes~/.hermes/config.yaml~/.hermes/lithermes/install-manifest.json<hermes-repo>/cli.py<hermes-repo>/gateway/run.py<hermes-repo>/hermes_cli/plugins.py

lithermes-ai@0.8.28

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code