Loading npm security reports…

pi-harness-runtime@1.1.7: AI-agent control-surface risk | LPM Firewall

registry / pi-harness-runtime / 1.1.7

pi-harness-runtime@1.1.7

[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.

AI Security Review

scanned 15m ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation modifies the separate Herdr agent's plugin and configuration directories. The installed plugin starts a detached shell-based clipboard bridge when Herdr loads it.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, followed by Herdr plugin startup

Impact

Executes package-supplied shell logic through Herdr and changes its keybindings without an explicit user setup action.

Mechanism

unconsented foreign agent plugin installation and startup registration

Policy narrative

On installation, the package runs a postinstall hook that recursively copies bundled plugins into Herdr's global plugin directory and creates Herdr configuration when absent. The copied plugin registers a detached startup command that runs a package shell script and configures plugin keybindings. This is unconsented mutation of a foreign AI-agent control surface; no network exfiltration is required for the harmful installation behavior.

Rationale

Source confirms an npm lifecycle hook installs and activates a package-controlled plugin in the unrelated global Herdr environment. This meets the install-time foreign AI-agent control-surface mutation block criterion.

Evidence

package.jsonscripts/copy-plugins.js.pi/plugins/herdr-clipboard/herdr-plugin.tomlconfig.toml.example.pi/plugins/herdr-clipboard/start-bridge.sh.pi/plugins/herdr-clipboard/tmux-watch.sh~/.pi-harness-runtime/cookies

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p ~/.pi-harness-runtime/cookies && node scripts/copy-plugins.js && ([ -f ~/.config/herdr/config.toml ] || mkdir -p ~/.config/herdr && cp config.toml.example ~/.config/herdr/...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harness/e2e/playwright-runner.tsView file

169// eslint-disable-next-line no-eval L170: return eval(String(cond)) as boolean; // eslint-disable-line L171: }, condition);

Low

Eval

Package source references a known benign dynamic code generation pattern.

harness/e2e/playwright-runner.tsView on unpkg · L169

packages/write-review/src/trigger.tsView file

67function scanDir(dir: string): void { L68: const { readdirSync, statSync } = require("fs"); L69: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/write-review/src/trigger.tsView on unpkg · L67

packages/scheduler-adapter/dist/cron.jsView file

3* L4: * Writes crontab entries for scheduled tasks. L5: * Entries are managed via a marker block so unschedule() is clean. L6: */ L7: import { execSync } from "node:child_process"; L8: import { writeFileSync, unlinkSync } from "node:fs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

packages/scheduler-adapter/dist/cron.jsView on unpkg · L3

scripts/scan-secrets.shView file

•path = scripts/scan-secrets.sh kind = build_helper sizeBytes = 1945 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/scan-secrets.shView on unpkg

.pi/plugins/herdr-clipboard/tmux-watch.shView file

•path = .pi/plugins/herdr-clipboard/tmux-watch.sh kind = payload_in_excluded_dir sizeBytes = 1169 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.pi/plugins/herdr-clipboard/tmux-watch.shView on unpkg

packages/auth/src/minimax-browser-auth.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.5 matchedPath = packages/auth/src/minimax-browser-auth.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/auth/src/minimax-browser-auth.tsView on unpkg

scripts/release-all.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.5 matchedPath = scripts/release-all.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/release-all.tsView on unpkg

packages/runtime/command-executor.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.5 matchedPath = packages/runtime/command-executor.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/runtime/command-executor.tsView on unpkg

packages/runtime/src/command-executor.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.5 matchedPath = packages/runtime/command-executor.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/runtime/src/command-executor.tsView on unpkg

packages/todo-bd-sync/src/detector.tsView file

•matchType = normalized_sha256 matchedPackage = pi-harness-runtime@1.1.5 matchedPath = packages/todo-bd-sync/src/detector.ts matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:1.1.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/todo-bd-sync/src/detector.tsView on unpkg