Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

lithermes-ai@0.8.45: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / lithermes-ai / 0.8.45

lithermes-ai@0.8.45

npx/bunx installer for the LitHermes Hermes plugin

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A user-invoked installer deploys an auto-loaded Hermes extension. Its pre-LLM lifecycle hook can perform a bounded automatic npm update on an interactive first turn; no install-time npm hook is present.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

`lithermes install --yes`, followed by an interactive Hermes session's first LLM turn.

Impact

Modifies the configured Hermes profile and can replace its installed Lithermes payload; no credential exfiltration or destructive chain was confirmed.

Mechanism

Hermes plugin deployment, lifecycle hooks, and guarded npm self-update.

Rationale

Not malicious under the stated boundary: mutation is user-command gated and there is no npm preinstall/install/postinstall behavior. Warn because a loaded agent extension can self-update from npm during an interactive pre-LLM lifecycle event.

Evidence

package.jsonsrc/lib/install.jsassets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/auto_update.pysrc/lib/updateNotifier.jsassets/lithermes-plugin~/.hermes/plugins/lithermes~/.hermes/config.yaml~/.hermes/lithermes/auto-update-receipt.json

Network endpoints1

registry.npmjs.org/lithermes-ai/latest

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Explicit `install --yes` copies a bundled Hermes plugin and enables it in the host configuration.
The bundled plugin auto-loads and registers `pre_llm_call` plus other Hermes lifecycle hooks.
On the first interactive LLM turn, the plugin can fetch npm registry metadata and invoke `npx` for an exact newer package version.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Installation refuses host mutation unless the user supplies `--yes`.
Update subprocess environment is allowlisted and omits token-bearing npm environment variables.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 184 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com, registry.npmjs.org

Source & flagged code

4 flagged · loading source

bin/lithermes.jsView file

1#!/usr/bin/env node L2: const { main } = require("../src/cli"); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

Findings

2 High5 Medium5 Low

HighPayload In Excluded Dirassets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py

HighKnown Malware Source Similarityassets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.ts

MediumDynamic Requirebin/lithermes.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/lithermes-plugin/litgoal/store.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

88%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainerswjgoarxiv

Version0.9.9

PublishedAug 12, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size5.52 MB

Files536

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → lithermes, lithermes-ai

Runtimenode >=18

Artifact9.90 MB · 536 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

bin/lithermes.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2const { main } = require("../src/cli");

3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

4main(process.argv.slice(2)).catch((error) => {

5 const code = Number.isInteger(error.exitCode) ? error.exitCode : 1;

6 console.error(error.message || String(error));

7 process.exit(code);

8});

9

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg