Loading npm security reports…

pi-harness-runtime@1.1.33: Malicious npm security report (Block) | LPM Firewall

registry / pi-harness-runtime / 1.1.33

pi-harness-runtime@1.1.33

[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically modifies the global Herdr configuration and installs a bundled startup plugin. When Herdr loads that plugin, it starts a detached tmux clipboard bridge.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation, followed by a Herdr startup.

Impact

Unconsented persistence and modification of a separate agent-facing control surface; the plugin can handle clipboard data in a background tmux session.

Mechanism

Postinstall writes global configuration and deploys an auto-start plugin.

Attack narrative

During npm postinstall, the package creates a Herdr configuration if absent and copies bundled files into the user's global Herdr plugin directory. The copied plugin declares a detached startup action. That action launches a tmux clipboard bridge which persists as a named tmux session and watches a clipboard buffer file. This is an unconsented install-time mutation of a separate global agent control surface.

Rationale

The package has a concrete automatic lifecycle chain that modifies a foreign global agent configuration and installs a persistent startup plugin. Source inspection found no need for remote theft to establish this install-hook abuse.

Evidence

package.jsonscripts/copy-plugins.js.pi/plugins/herdr-clipboard/herdr-plugin.toml.pi/plugins/herdr-clipboard/start-bridge.sh~/.pi-harness-runtime/cookies~/.config/herdr/config.toml~/.config/herdr/plugins

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harness/langchain/daemon.tsView file

466): Promise<void> { L467: const { execSync } = await import("node:child_process"); L468: let output: string;

High

Child Process

Package source references child process execution.

harness/langchain/daemon.tsView on unpkg · L466

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = harness/langchain/daemon.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

harness/langchain/daemon.tsView on unpkg

harness/ssh-hang-recovery.tsView file

66// Execute with timeout L67: const result = await execAsync( L68: `${sshBase} '${command.replace(/'/g, "'\\''")}'`,

High

Shell

Package source references shell execution.

harness/ssh-hang-recovery.tsView on unpkg · L66

harness/e2e/playwright-runner.tsView file

169// eslint-disable-next-line no-eval L170: return eval(String(cond)) as boolean; // eslint-disable-line L171: }, condition);

Low

Eval

Package source references a known benign dynamic code generation pattern.

harness/e2e/playwright-runner.tsView on unpkg · L169

harness/langchain/checkpointer.tsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

harness/langchain/checkpointer.tsView on unpkg

98if (existsSync(path)) { L99: const fd = require("node:fs").openSync(path, "a"); L100: require("node:fs").writeSync(fd, line);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

harness/langchain/checkpointer.tsView on unpkg · L98

packages/scheduler-adapter/dist/cron.jsView file

3* L4: * Writes crontab entries for scheduled tasks. L5: * Entries are managed via a marker block so unschedule() is clean. L6: */ L7: import { execSync } from "node:child_process"; L8: import { writeFileSync, unlinkSync } from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/scheduler-adapter/dist/cron.jsView on unpkg · L3

harness/e2e/auto-test-loop.tsView file

493try { L494: execSync("npm install", { cwd: projectRoot, stdio: "ignore" }); L495: return { fixed: true, description: "Ran npm install" }; L496: } catch { L497: return { fixed: false, description: "npm install failed" }; L498: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

harness/e2e/auto-test-loop.tsView on unpkg · L493

scripts/scan-secrets.shView file

•path = scripts/scan-secrets.sh kind = build_helper sizeBytes = 1945 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/scan-secrets.shView on unpkg

.pi/plugins/herdr-clipboard/tmux-watch.shView file

•path = .pi/plugins/herdr-clipboard/tmux-watch.sh kind = payload_in_excluded_dir sizeBytes = 1169 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/plugins/herdr-clipboard/tmux-watch.shView on unpkg

packages/auth/dist/minimax-browser-auth.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/auth/dist/minimax-browser-auth.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/auth/dist/minimax-browser-auth.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 445a69b5b2db03da signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/auth/dist/minimax-browser-auth.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 shingleOverlap = 119 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

packages/auth/dist/minimax-browser-auth.jsView on unpkg

packages/auth/src/minimax-browser-auth.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/auth/src/minimax-browser-auth.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/auth/src/minimax-browser-auth.tsView on unpkg

packages/clipboard/dist/src/gist-relay.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = [redacted]-relay.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/clipboard/dist/src/gist-relay.jsView on unpkg

packages/clipboard/src/gist-relay.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/clipboard/src/gist-relay.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/clipboard/src/gist-relay.tsView on unpkg

packages/codex-adapter/dist/executor.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/codex-adapter/dist/executor.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-adapter/dist/executor.jsView on unpkg

packages/codex-adapter/src/executor.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/codex-adapter/src/executor.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/codex-adapter/src/executor.tsView on unpkg

packages/generic-web-plugin/dist/analyzer.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/generic-web-plugin/dist/analyzer.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/generic-web-plugin/dist/analyzer.jsView on unpkg

packages/generic-web-plugin/src/analyzer.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/generic-web-plugin/src/analyzer.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/generic-web-plugin/src/analyzer.tsView on unpkg

packages/code-review/dist/engine.jsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/code-review/dist/engine.js matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/code-review/dist/engine.jsView on unpkg

packages/code-review/src/engine.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.34 matchedPath = packages/code-review/src/engine.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.34 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/code-review/src/engine.tsView on unpkg