registry / lithermes-ai / 0.9.9

lithermes-ai@0.9.9

npx/bunx installer for the LitHermes Hermes plugin

AI Security Review

scanned 5h ago · by lpm-firewall-ai

On the first interactive LLM turn, the installed agent plugin can download and execute a newer lithermes-ai release. That release replaces the agent plugin and modifies Hermes configuration without a fresh user confirmation.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

An interactive first LLM call after the plugin has been installed, when a newer registry version exists.

Impact

A registry-selected newer package release gains automatic execution and can alter the Hermes agent control surface.

Mechanism

Hidden pre-LLM self-update through npx followed by plugin and config replacement.

Attack narrative

After installation, the auto-loaded plugin registers pre_llm_call. On a first interactive turn it queries the npm registry and runs npx against a newer exact lithermes-ai release through a private command hidden from normal help. The child installer removes the current plugin payload, copies its replacement, and writes Hermes configuration. This is an automatic runtime self-dependency chain that changes an AI-agent control surface without a fresh user action.

Rationale

The package contains a concealed automatic self-update path from an AI-agent lifecycle hook to a newer release of itself, followed by control-surface mutation. Although it lacks an npm install hook and limits inherited environment variables, the complete hidden self-update chain is concrete and automatic.

Evidence

assets/lithermes-plugin/plugin.yamlassets/lithermes-plugin/auto_update.pysrc/cli.jssrc/lib/install.js~/.hermes/plugins/lithermes~/.hermes/config.yaml

lithermes-ai@0.9.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code