Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

lithermes-ai@0.8.47: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / lithermes-ai / 0.8.47

lithermes-ai@0.8.47

npx/bunx installer for the LitHermes Hermes plugin

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time npm lifecycle execution occurs. After explicit installation, the package-owned Hermes plugin runs a guarded pre_llm_call auto-update that fetches the npm registry and invokes npx to replace its own plugin payload.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Explicit `lithermes install --yes`, then an interactive first Hermes turn when a newer version exists.

Impact

A future registry version can be installed into the Hermes plugin/config surface without a separate update command.

Mechanism

First-party Hermes plugin setup with guarded automatic npm update.

Rationale

Source shows a real first-party agent extension lifecycle with automatic remote package replacement, so it warrants warning under policy. No concrete malicious chain or unconsented npm install hook was found.

Evidence

package.jsonassets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/auto_update.pysrc/lib/install.jssrc/lib/updateNotifier.js~/.hermes/plugins/lithermes~/.hermes/config.yaml

Network endpoints1

registry.npmjs.org/lithermes-ai/latest

Decision evidence

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Installed plugin auto-loads lifecycle hooks including pre_llm_call.
On an interactive first turn, the hook fetches npm latest and runs npx for that exact version.
Explicit install copies a first-party plugin and updates Hermes config.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Auto-update is limited to interactive first turns and has opt-out/recursion guards.
Child update environment excludes npm config, proxies, NODE_OPTIONS, and token-bearing variables.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 184 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com, registry.npmjs.org

Source & flagged code

4 flagged · loading source

bin/lithermes.jsView file

1#!/usr/bin/env node L2: const { main } = require("../src/cli"); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.44 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.44 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

Findings

2 High5 Medium5 Low

HighPayload In Excluded Dirassets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py

HighKnown Malware Source Similarityassets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.ts

MediumDynamic Requirebin/lithermes.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/lithermes-plugin/litgoal/store.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Maintainerswjgoarxiv

Version0.9.9

PublishedAug 15, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size5.50 MB

Files537

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsbin → lithermes, lithermes-ai

Runtimenode >=18

Artifact9.86 MB · 537 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

bin/lithermes.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2const { main } = require("../src/cli");

3

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

4main(process.argv.slice(2)).catch((error) => {

5 const code = Number.isInteger(error.exitCode) ? error.exitCode : 1;

6 console.error(error.message || String(error));

7 process.exit(code);

8});

9

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.44 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.44 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg