registry / @dzhechkov/harness-core / 0.3.40

@dzhechkov/harness-core@0.3.40

Shared harness logic - skill loading, additive apply, and the init/sync/verify/doctor operations.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 432 KB of source, external domains: api.github.com, api.npmjs.org, github.com, json-schema.org, raw.githubusercontent.com

Source & flagged code

3 flagged

dist/publish.jsView file

Lines 1-28javascript

1/**

2 * Automated publish — discovers changed packages, bumps patch versions,

3 * builds, and publishes to npm.

4 *

5 * @packageDocumentation

6 */

7import { existsSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

8import { join } from 'node:path';

9import { execSync } from 'node:child_process';

10/** Bump patch version: 0.3.11 → 0.3.12 */

High

Child Process

Package source references child process execution.

dist/publish.jsView on unpkg · L8

11export function bumpPatch(version) {

12 // Parse the core x.y.z, tolerating a 2-part "x.y" (treated as x.y.0) and a

13 // prerelease/build suffix (e.g. "1.2.3-beta.2"). A prerelease bumps to its

14 // release (x.y.z), which semver-orders ABOVE the prerelease — never below it,

15 // and never silently drops to a lower number (audit #12).

16 const core = (version.split('+')[0] ?? version).split('-');

17 const hasPrerelease = core.length > 1;

18 const nums = (core[0] ?? '').split('.');

19 const major = parseInt(nums[0] ?? '0', 10) || 0;

20 const minor = parseInt(nums[1] ?? '0', 10) || 0;

21 const patch = parseInt(nums[2] ?? '0', 10) || 0;

22 // Releasing a prerelease keeps the same x.y.z (it outranks the prerelease);

23 // a normal release bumps the patch.

24 return hasPrerelease ? `${major}.${minor}.${patch}` : `${major}.${minor}.${patch + 1}`;

25}

26/** Compare two x.y.z(-pre) versions by their core triple: >0 if a>b, <0 if a<b. */

27export function compareVersions(a, b) {

28 const core = (v) => ((v.split('+')[0] ?? v).split('-')[0] ?? '').split('.').map((n) => parseInt(n, 10) || 0);

dist/upgrade.jsView file

Lines 1-21javascript

1/**

2 * Skill upgrade — detects installed skills and re-applies from canonical source.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/upgrade.jsView on unpkg · L1

3 *

4 * @packageDocumentation

5 */

6import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';

7import { join } from 'node:path';

dist/setup.jsView file

Lines 6-46javascript

6 * 1. Skills installation (via init)

7 * 2. Claude Code hooks (session-start/end for memory)

8 * 3. Memory database initialization (.dz/memory.db)

9 * 4. Pretrain (project analysis → auto-

Source & flagged code

3 flagged · loading source

dist/publish.jsView file

8import { join } from 'node:path'; L9: import { execSync } from 'node:child_process'; L10: /** Bump patch version: 0.3.11 → 0.3.12 */

High

Child Process

Package source references child process execution.

dist/publish.jsView on unpkg · L8

dist/upgrade.jsView file

1/** L2: * Skill upgrade — detects installed skills and re-applies from canonical source.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/upgrade.jsView on unpkg · L1

dist/setup.jsView file

26type: 'command', L27: command: `node -e "const fs=require('fs');const d=new Date().toISOString();try{require('child_process').execSync('npx agentdb add \\'${rvfPath}\\' \\'session-start: '+d+'\\'',{stdi... L28: }],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup.jsView on unpkg · L26

Findings

3 High3 Medium5 Low

HighChild Processdist/publish.js

HighShell

HighRuntime Package Installdist/setup.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/upgrade.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/publish.jsView file

Lines 1-28javascript

1/**

2 * Automated publish — discovers changed packages, bumps patch versions,

3 * builds, and publishes to npm.

4 *

5 * @packageDocumentation

6 */

7import { existsSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';

8import { join } from 'node:path';

9import { execSync } from 'node:child_process';

10/** Bump patch version: 0.3.11 → 0.3.12 */

High

Child Process

Package source references child process execution.

dist/publish.jsView on unpkg · L8

11export function bumpPatch(version) {

12 // Parse the core x.y.z, tolerating a 2-part "x.y" (treated as x.y.0) and a

13 // prerelease/build suffix (e.g. "1.2.3-beta.2"). A prerelease bumps to its

14 // release (x.y.z), which semver-orders ABOVE the prerelease — never below it,

15 // and never silently drops to a lower number (audit #12).

16 const core = (version.split('+')[0] ?? version).split('-');

17 const hasPrerelease = core.length > 1;

18 const nums = (core[0] ?? '').split('.');

19 const major = parseInt(nums[0] ?? '0', 10) || 0;

20 const minor = parseInt(nums[1] ?? '0', 10) || 0;

21 const patch = parseInt(nums[2] ?? '0', 10) || 0;

22 // Releasing a prerelease keeps the same x.y.z (it outranks the prerelease);

23 // a normal release bumps the patch.

24 return hasPrerelease ? `${major}.${minor}.${patch}` : `${major}.${minor}.${patch + 1}`;

25}

26/** Compare two x.y.z(-pre) versions by their core triple: >0 if a>b, <0 if a<b. */

27export function compareVersions(a, b) {

28 const core = (v) => ((v.split('+')[0] ?? v).split('-')[0] ?? '').split('.').map((n) => parseInt(n, 10) || 0);

dist/upgrade.jsView file

Lines 1-21javascript

1/**

2 * Skill upgrade — detects installed skills and re-applies from canonical source.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/upgrade.jsView on unpkg · L1

3 *

4 * @packageDocumentation

5 */

6import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';

7import { join } from 'node:path';

dist/setup.jsView file

Lines 6-46javascript

6 * 1. Skills installation (via init)

7 * 2. Claude Code hooks (session-start/end for memory)

8 * 3. Memory database initialization (.dz/memory.db)

9 * 4. Pretrain (project analysis → auto-