Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

lithermes-ai@0.8.44: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / lithermes-ai / 0.8.44

lithermes-ai@0.8.44

npx/bunx installer for the LitHermes Hermes plugin

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A user-confirmed installer deploys and enables a persistent LitHermes plugin. That plugin auto-loads hooks and can fetch and install newer package versions during a qualifying interactive first turn.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User runs `lithermes install --yes`, then starts an interactive top-level Hermes session.

Impact

The package gains ongoing control over the installed Hermes plugin surface and can replace its own payload from npm.

Mechanism

First-party Hermes extension installation with guarded registry-driven self-update.

Rationale

No malicious install hook, credential harvesting, or exfiltration was found. The explicit installer plus automatic hook-driven self-update is a real first-party agent extension lifecycle risk requiring a warning.

Evidence

src/lib/install.jsassets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/core.pyassets/lithermes-plugin/auto_update.pypackage.json~/.hermes/plugins/lithermes~/.hermes/config.yaml~/.hermes/lithermes/install-manifest.json

Network endpoints1

registry.npmjs.org/lithermes-ai/latest

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `install --yes` replaces a Hermes plugin payload and enables it in Hermes configuration.
Bundled plugin auto-loads with LLM and tool lifecycle hooks.
On an interactive first LLM turn, the plugin invokes an automatic update bridge.
The update bridge queries npm registry and runs an exact-version `npx` installer.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Foreign Hermes changes require the user-invoked install command and `--yes`.
Registry response/version handling and child environment are bounded and sanitized; no credential exfiltration found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 184 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com, registry.npmjs.org

Source & flagged code

4 flagged · loading source

bin/lithermes.jsView file

1#!/usr/bin/env node L2: const { main } = require("../src/cli"); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

Findings

2 High5 Medium5 Low

HighPayload In Excluded Dirassets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py

HighKnown Malware Source Similarityassets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.ts

MediumDynamic Requirebin/lithermes.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/lithermes-plugin/litgoal/store.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

93%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainerswjgoarxiv

Version0.9.9

PublishedAug 11, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size5.52 MB

Files536

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → lithermes, lithermes-ai

Runtimenode >=18

Artifact9.90 MB · 536 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

bin/lithermes.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2const { main } = require("../src/cli");

3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

4main(process.argv.slice(2)).catch((error) => {

5 const code = Number.isInteger(error.exitCode) ? error.exitCode : 1;

6 console.error(error.message || String(error));

7 process.exit(code);

8});

9

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg