registry / lithermes-ai / 0.9.0

lithermes-ai@0.9.0

npx/bunx installer for the LitHermes Hermes plugin

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 193 KB of source, external domains: biomejs.dev, clangd.llvm.org, github.com, registry.npmjs.org

Source & flagged code

5 flagged

bin/lithermes.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2const { main } = require("../src/cli");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/lithermes.jsView on unpkg · L1

4main(process.argv.slice(2)).catch((error) => {

5 const code = Number.isInteger(error.exitCode) ? error.exitCode : 1;

6 console.error(error.message || String(error));

7 process.exit(code);

8});

assets/lithermes-plugin/litgoal/store.pyView file

•path = assets/lithermes-plugin/litgoal/store.py kind = build_helper sizeBytes = 14394 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/lithermes-plugin/litgoal/store.pyView on unpkg

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView file

•path = assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.py kind = payload_in_excluded_dir sizeBytes = 1742 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/lithermes-plugin/skills/lit-scientific-visualization/original/045_scientific-visualization/tests/test_figure_export.pyView on unpkg

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView file

•matchType = normalized_sha256 matchedPackage = litclaude-ai@0.3.46 matchedPath = [redacted]-no-excuse-rules.ts matchedIdentity = npm:bGl0Y2xhdWRlLWFp:0.3.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/lithermes-plugin/skills/programming/scripts/typescript/check-no-excuse-rules.tsView on unpkg

src/lib/modelConfig.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = lithermes-ai@0.8.47 matchedIdentity = npm:bGl0aGVybWVzLWFp:0.8.47 similarity = 0.793 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/modelConfig.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/lithermes.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code