hermes-runtime

No direct indicators of embedded malware, but the module has meaningful security risks typical of tunnel managers: (1) execSync executes a shell command string containing an interpolated config-derived port value without explicit pre-interpolation validation, creating a plausible command-injection surface if configOverride/config.json can be influenced; (2) SSH host key checking uses accept-new (weaker MITM resistance); and (3) tunnel destination/ports are fully config-driven and the tunnel runs detached, increasing impact of configuration abuse. If config integrity is trustworthy and local ports are constrained to integers, risk is reduced; otherwise, review/mitigate command execution and SSH verification behavior.