Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

lithermes-ai@0.8.46: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / lithermes-ai / 0.8.46

lithermes-ai@0.8.46

npx/bunx installer for the LitHermes Hermes plugin

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A user-invoked installer deploys an auto-loaded Hermes agent extension. On eligible interactive turns, its hook can retrieve and install a newer package version.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User runs lithermes install --yes; later first interactive Hermes turn.

Impact

Can replace the installed agent extension and affect Hermes hook behavior; source also supports guarded host compatibility patches.

Mechanism

Auto-loaded hook performs registry-driven npx self-update and modifies its Hermes-owned plugin/config surface.

Rationale

This is not concrete malware, but it creates a guarded, persistent agent-extension update/control surface with optional host-source patching. Per policy, that warrants a warning rather than a block.

Evidence

src/lib/install.jssrc/lib/patch.jsassets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/auto_update.py

Network endpoints1

registry.npmjs.org/lithermes-ai/latest

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence with false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

as Dangerous Capability

medium

Evidence for warning

Auto-loaded Hermes plugin registers pre-LLM and tool/session hooks.
Explicit install copies the bundled plugin and enables it in Hermes configuration.
The installed hook checks npm registry then runs an exact-version npx update.
Installer may patch detected Hermes runtime sources as part of setup.

Evidence against

No npm preinstall/install/postinstall lifecycle hook exists.
Install refuses configuration mutation unless the user supplies --yes.
Update path is limited to interactive first turns and sanitizes child environment.
Observed network endpoint is the package-aligned npm registry; no credential exfiltration found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 184 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com, registry.npmjs.org

Source & flagged code

4 flagged · loading source

bin/lithermes.jsView file

1#!/usr/bin/env node L2: const { main } = require("../src/cli"); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

Findings

2 High5 Medium5 Low

HighPayload In Excluded Dirassets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py

HighKnown Malware Source Similarityassets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.ts

MediumDynamic Requirebin/lithermes.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/lithermes-plugin/litgoal/store.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

93%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainerswjgoarxiv

Version0.9.9

PublishedAug 14, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size5.52 MB

Files537

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → lithermes, lithermes-ai

Runtimenode >=18

Artifact9.91 MB · 537 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

bin/lithermes.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2const { main } = require("../src/cli");

3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

4main(process.argv.slice(2)).catch((error) => {

5 const code = Number.isInteger(error.exitCode) ? error.exitCode : 1;

6 console.error(error.message || String(error));

7 process.exit(code);

8});

9

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = @kl-c/matrixos@0.3.65 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:QGtsLWMvbWF0cml4b3M:0.3.65 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg