registry / @flarehr/apollo-benefits / 0.4.20665

@flarehr/apollo-benefits@0.4.20665

Flare Benefits

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The only non-runtime mutation surface is the `prepare` lifecycle hook. It invokes Husky setup for a parent-project Git hook directory; no concrete malicious hook contents are packaged.

Static reason

No blocking static signals were detected.

Trigger

npm lifecycle execution of `prepare`, such as source/development installation.

Impact

May configure development VCS hooks; no payload, persistence beyond Husky hooks, or exfiltration was confirmed.

Mechanism

Prepare-time Husky Git-hook setup targeting a parent project path.

Rationale

Source inspection found a prepare-only Husky setup command that crosses into a parent project path, which warrants a warning under the lifecycle policy. The distributed browser code otherwise shows ordinary application authentication, API, and analytics behavior without a concrete malicious chain.

Evidence

package.jsondist/sw-esm.jsdist/index.htmldist/config.jsondist/assets/index-f2d12afc.jsdist/assets/index-e3b6610a.jsdist/assets/vendor-a6810c59.jsdist/assets/oidc-client-3a9688bc.jsdist/assets/datadog-92341ed7.js

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` defines a `prepare` lifecycle command.
That command invokes Husky installation and targets `../benefits-client/.husky`, outside the package directory.

Evidence against

Published contents are a browser application under `dist/`, not an installer payload.
No `preinstall`, `install`, or `postinstall` hook is present.
`dist/sw-esm.js` deregisters an existing service worker rather than persisting one.
Runtime networking is app/analytics aligned: Flare, Google Tag Manager, Segment, and configured API/OIDC endpoints.
No source evidence of shell payload execution, credential harvesting, exfiltration, or AI-agent control-surface writes.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.15 MB of source, external domains: bit.ly, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, docs.datadoghq.com, embed.typeform.com, fb.me, github.com, www.datad0g-browser-agent.com, www.datadoghq-browser-agent.com, www.flarehr.com, www.w3.org

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

779}`;function Mm(){var e=Tm,t=Cm,n=X.cssPrefix,r=X.replacementClass,i=sC;if(n!==e||r!==t){var a=new RegExp("\\.".concat(e,"\\-"),"g"),o=new RegExp("\\--".concat(e,"\\-"),"g"),u=new RegExp("\\.".concat(t),"g");i=i.replace(a,".".concat(n,"-")).replace(o,"--".concat(n,"-")).replace(u,".".concat(r))}return i}var vd=!1;function pu(){X.autoAddCss&&!vd&&(rC(Mm()),vd=!0)}var lC={mixout:function(){return{dom:{css:Mm,insertCss:pu}}},hooks:function(){return{beforeDOMElementCreation:function(){pu()},beforeI2svg:function(){pu()}}}},zt=dn||{};zt[Wt]||(zt[Wt]={});zt[Wt].styles||(zt[Wt].styles={});zt[Wt].hooks| ...

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

781`),e.removeAttribute(n),r()}).catch(i)}else r()}else r()})}function nI(e){return Promise.all([Cd(e,"::before"),Cd(e,"::after")])}function rI(e){return e.parentNode!==document.head&&!~zT.indexOf(e.tagName.toUpperCase())&&!e.getAttribute(ds)&&(!e.parentNode||e.parentNode.tagName!=="svg")}function Id(e){if(Vt)return new Promise(function(t,n){var r=Lr(e.querySelectorAll("*")).filter(rI).map(nI),i=Hl.begin("searchPseudoElements");Gm(),Promise.all(r).then(function(){i(),_s(),t()}).catch(function(){i(),_s(),n()})})}var iI={hooks:function(){return{mutationObserverCallbacks:function(n){return n.pseudoE ...

782In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function SI(e){var t,n=e.beat,r=e.fade,i=e.beatFade,a=e.bounce,o=e.shake,u=e.flash,s=e.spin,c=e.spinPulse,f=e.spinReverse,l=e.pulse,d=e.fixedWidth,v=e.inverse,p=e.border,h=e.listItem,b=e.flip,_=e.size,y=e.rotation,m=e.pull,g=(t

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

788 </svg>`),dt=te==null?void 0:te.startsWith("http");return re.innerHTML=dt?"<img alt='popover trigger icon button' src='".concat(te,"'/>"):te??ge,re.dataset.testid="default-icon",re}(R.customIcon,R.buttonColor||m.buttonColor),K=function(){var te=document.createElement("div");te.className="tf-v1-spinner";var Q=document.createElement("div");return Q.className="tf-v1-popover-button-icon",Q.dataset.testid="spinner-icon",Q.append(te),Q}(),G=y(),x=y("button","tf-v1-popover-close"),U=function(te,Q){Q===void 0&&(Q={});var ae=(0,h.getTextColor)(te),re=document

789 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8

790 </svg>`),ge=H==null?void 0:H.startsWith("http");return ae.innerHTML=ge?"<img alt='popover trigger icon button' src='".concat(H,"'/>"):H??re,ae.dataset.testid="default-icon",ae}(w.customIcon,w.buttonColor||b.buttonColor,w.buttonTextColor,w.buttonTextSize),K=_(),G=_("button","tf-v1-sidetab-close");(w.container||document.body).append(I),C.append(A),I.append(M),I.append(G),M.append(V),M.

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

794It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=function(){if(window.dataLayer){var g=window.dataLayer.find(function(E){return E.length>1&&E[0]==="config"});return g&&g[1]}}()),!_)return void v("the tracking ID could not be retrieved");var y=!1;window.gtag("get",_,"client_id",function(g){y=!0,(0,l.sendGaIdMessage)(h,g,p)}),setTimeout(function(){y||v("the tracker with ID ".concat(_," was not found"))},3e3)}else try{var m=function(g,E){return E?g.find(function(O){return O. ...

795In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c},e:function(c){u=!0,a=c},f:function(){try{o||n.return==null||n.return()}finally{if(u)throw a}}}}function pR(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function Ba(e,t){return Ba=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(n,r){return n.__proto__=r,n},Ba(e,t)}function WL(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Supe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

799 */var jd=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,gR=/\\([\u000b\u0020-\u00ff])/g,bR=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/,_R=wR;function wR(e){if(!e)throw new TypeError("argument string is required");var t=typeof e=="object"?ER(e):e;if(typeof t!="string")throw new TypeError("argument string is required to be a string");var n=t.indexOf(";"),r=n!==-1?t.slice(0,n)

800

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/assets/vendor-a6810c59.jsView file

793L794: It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=functio... L795: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

Findings

2 Medium7 Low

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/vendor-a6810c59.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

800

Long lines were clipped for display.