Loading npm security reports…

pi-harness-runtime@1.1.5: AI-agent control-surface risk | LPM Firewall

registry / pi-harness-runtime / 1.1.5

pi-harness-runtime@1.1.5

[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the package installs a plugin and configuration into the unrelated Herdr user control surface. That plugin declares detached startup and launches a persistent clipboard bridge.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall, followed by Herdr plugin startup

Impact

Unconsented modification of user-level Herdr configuration and plugin execution surface.

Mechanism

automatic foreign agent-plugin installation with detached clipboard watcher

Policy narrative

Installing the package runs postinstall without a user command. It copies all bundled plugins into ~/.config/herdr/plugins and creates a Herdr configuration file. The bundled plugin is configured for detached startup; its script starts a persistent tmux watcher that processes clipboard-bridge content. This is an unconsented install-time mutation of a foreign user-level agent/plugin control surface.

Rationale

The automatic postinstall writes and activates a third-party Herdr plugin surface; this meets the install-control-surface block boundary. No lifecycle network exfiltration was found, but it is not required for this concrete control-surface mutation.

Evidence

package.jsonscripts/copy-plugins.js.pi/plugins/herdr-clipboard/herdr-plugin.toml.pi/plugins/herdr-clipboard/start-bridge.sh.pi/plugins/herdr-clipboard/tmux-watch.sh~/.pi-harness-runtime/cookies~/.config/herdr/config.toml~/.config/herdr/plugins/herdr-clipboard

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harness/e2e/playwright-runner.tsView file

169// eslint-disable-next-line no-eval L170: return eval(String(cond)) as boolean; // eslint-disable-line L171: }, condition);

Low

Eval

Package source references a known benign dynamic code generation pattern.

harness/e2e/playwright-runner.tsView on unpkg · L169

packages/write-review/src/trigger.tsView file

67function scanDir(dir: string): void { L68: const { readdirSync, statSync } = require("fs"); L69: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/write-review/src/trigger.tsView on unpkg · L67

packages/scheduler-adapter/dist/cron.jsView file

3* L4: * Writes crontab entries for scheduled tasks. L5: * Entries are managed via a marker block so unschedule() is clean. L6: */ L7: import { execSync } from "node:child_process"; L8: import { writeFileSync, unlinkSync } from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/scheduler-adapter/dist/cron.jsView on unpkg · L3

scripts/scan-secrets.shView file

•path = scripts/scan-secrets.sh kind = build_helper sizeBytes = 1945 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/scan-secrets.shView on unpkg

.pi/plugins/herdr-clipboard/tmux-watch.shView file

•path = .pi/plugins/herdr-clipboard/tmux-watch.sh kind = payload_in_excluded_dir sizeBytes = 1169 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/plugins/herdr-clipboard/tmux-watch.shView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-28json

1{

2 "name": "pi-harness-runtime",

3 "version": "1.1.5",

4 "description": "[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.",

5 "type": "module",

6 "scripts": {

7 "test": "node --test",

8 "postinstall": "mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/config.toml)",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L8

9 "release": "bun scripts/release-all.ts",

10 "release:patch": "bun scripts/release-all.ts --release-as patch",

11 "release:minor": "bun scripts/release-all.ts --release-as minor",

12 "release:major": "bun scripts/release-all.ts --release-as major",

13 "release:dry-run": "bun scripts/release-all.ts --dry-run",

14 "auth:minimax": "bun packages/auth/src/run-minimax-auth.ts auth",

15 "auth:minimax:check": "bun packages/auth/src/run-minimax-auth.ts check",

16 "auth:minimax:scrape": "bun packages/auth/src/run-minimax-auth.ts scrape",

17 "skills:sync": "bun scripts/skills-sync.ts",

18 "skills:sync:check": "bun scripts/skills-sync.ts --check-only",

19 "build": "for pkg in packages/*/; do [ -f \"${pkg}tsconfig.json\" ] && [ \"$pkg\" != \"packages/provider-router/\" ] && node_modules/.bin/tsc -p \"${pkg}tsconfig.json\" --skipLibCheck > /dev/null 2>&1 || true; done",

20 "prepublishOnly": "bun run build"

21 },

22 "bin": {

23 "harness-auth": "packages/auth/src/run-minimax-auth.ts"

24 },

25 "files": [

26 "*.ts",

27 "harness/**/*.ts",

28 "packages/**/src/**/*.{ts,js}",

harness/e2e/playwright-runner.tsView file

Lines 149-189typescript

149 await this.page.waitForSelector(selector, {

150 timeout: timeoutMs ?? this.config.timeout,

151 });

152 }

153

154 /**

155 * Take a screenshot

156

packages/write-review/src/trigger.tsView file

Lines 47-87typescript

47 return {

48 category: "root",

49 filename: parts[0],

50 };

51}

52

53/**

54 * Get all wiki prompt files in a project

55 */

56

packages/scheduler-adapter/dist/cron.jsView file

Lines 1-23javascript

1/**

2 * Cron Scheduler Adapter — RFC-0101 §6

3 *

4 * Writes crontab entries for scheduled tasks.

5 * Entries are managed via a marker block so unschedule() is clean.

6 */

7import { execSync } from "node:child_process";

8import { writeFileSync, unlinkSync } from

scripts/scan-secrets.shView file

•path = scripts/scan-secrets.sh kind = build_helper sizeBytes = 1945 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/scan-secrets.shView on unpkg

.pi/plugins/herdr-clipboard/tmux-watch.shView file

•path = .pi/plugins/herdr-clipboard/tmux-watch.sh kind = payload_in_excluded_dir sizeBytes = 1169 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/plugins/herdr-clipboard/tmux-watch.shView on unpkg