registry / @flarehr/apollo-benefits / 0.4.20076

@flarehr/apollo-benefits@0.4.20076

Flare Benefits

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed credential theft, remote payload execution, or destructive behavior is established. The only install-adjacent behavior is a prepare hook that invokes Husky for a project hook directory.

Static reason

No blocking static signals were detected.

Trigger

npm lifecycle prepare

Impact

May configure repository Git hooks; no malicious hook payload is shipped or evidenced.

Mechanism

prepare-time Husky VCS-hook setup

Rationale

The package is a compiled Flare Benefits web application with expected OIDC/API, analytics, and remote first-party module loading. Its prepare-time Husky setup is a real lifecycle risk but does not establish malicious behavior.

Evidence

package.jsondist/index.htmldist/assets/index-88ca7bc1.jsdist/assets/vendor-a6810c59.jsdist/assets/oidc-client-3a9688bc.jsdist/config.json

Network endpoints5

npm-cdn.flarehr.com/@flarehr/salpac-cars-calculator@__ENVIRONMENT/dist/salpac-cars-calculator.jsnpm-cdn.flarehr.com/@flarehr/apollo-customer-workplace-link@__ENVIRONMENT/build/bundle.esm.jsnpm-cdn.flarehr.com/@flarehr/benefits-plan-assessment@__ENVIRONMENT/dist/benefits-plan-assessment.jswww.googletagmanager.com/gtm.js?id=cdn.segment.com/analytics.js/v1/

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json:21 declares npm prepare running Husky against ../benefits-client/.husky.
dist/index.html loads runtime modules from npm-cdn.flarehr.com.

Evidence against

Shipped contents are a browser SPA under dist/; no Node entrypoint or bin is declared.
No child_process, filesystem-write, shell, credential-file, or AI-agent-control references were found in package artifacts.
dist/assets/index-88ca7bc1.js bootstraps OIDC/API configuration, session storage, and product analytics.
The vendor dynamic-code hint resolves to bundled UI/library code; no executable eval call was found.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.15 MB of source, external domains: bit.ly, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, docs.datadoghq.com, embed.typeform.com, fb.me, github.com, www.datad0g-browser-agent.com, www.datadoghq-browser-agent.com, www.flarehr.com, www.w3.org

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

779}`;function Mm(){var e=Tm,t=Cm,n=X.cssPrefix,r=X.replacementClass,i=sC;if(n!==e||r!==t){var a=new RegExp("\\.".concat(e,"\\-"),"g"),o=new RegExp("\\--".concat(e,"\\-"),"g"),u=new RegExp("\\.".concat(t),"g");i=i.replace(a,".".concat(n,"-")).replace(o,"--".concat(n,"-")).replace(u,".".concat(r))}return i}var vd=!1;function pu(){X.autoAddCss&&!vd&&(rC(Mm()),vd=!0)}var lC={mixout:function(){return{dom:{css:Mm,insertCss:pu}}},hooks:function(){return{beforeDOMElementCreation:function(){pu()},beforeI2svg:function(){pu()}}}},zt=dn||{};zt[Wt]||(zt[Wt]={});zt[Wt].styles||(zt[Wt].styles={});zt[Wt].hooks| ...

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

781`),e.removeAttribute(n),r()}).catch(i)}else r()}else r()})}function nI(e){return Promise.all([Cd(e,"::before"),Cd(e,"::after")])}function rI(e){return e.parentNode!==document.head&&!~zT.indexOf(e.tagName.toUpperCase())&&!e.getAttribute(ds)&&(!e.parentNode||e.parentNode.tagName!=="svg")}function Id(e){if(Vt)return new Promise(function(t,n){var r=Lr(e.querySelectorAll("*")).filter(rI).map(nI),i=Hl.begin("searchPseudoElements");Gm(),Promise.all(r).then(function(){i(),_s(),t()}).catch(function(){i(),_s(),n()})})}var iI={hooks:function(){return{mutationObserverCallbacks:function(n){return n.pseudoE ...

782In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function SI(e){var t,n=e.beat,r=e.fade,i=e.beatFade,a=e.bounce,o=e.shake,u=e.flash,s=e.spin,c=e.spinPulse,f=e.spinReverse,l=e.pulse,d=e.fixedWidth,v=e.inverse,p=e.border,h=e.listItem,b=e.flip,_=e.size,y=e.rotation,m=e.pull,g=(t

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

788 </svg>`),dt=te==null?void 0:te.startsWith("http");return re.innerHTML=dt?"<img alt='popover trigger icon button' src='".concat(te,"'/>"):te??ge,re.dataset.testid="default-icon",re}(R.customIcon,R.buttonColor||m.buttonColor),K=function(){var te=document.createElement("div");te.className="tf-v1-spinner";var Q=document.createElement("div");return Q.className="tf-v1-popover-button-icon",Q.dataset.testid="spinner-icon",Q.append(te),Q}(),G=y(),x=y("button","tf-v1-popover-close"),U=function(te,Q){Q===void 0&&(Q={});var ae=(0,h.getTextColor)(te),re=document

789 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8

790 </svg>`),ge=H==null?void 0:H.startsWith("http");return ae.innerHTML=ge?"<img alt='popover trigger icon button' src='".concat(H,"'/>"):H??re,ae.dataset.testid="default-icon",ae}(w.customIcon,w.buttonColor||b.buttonColor,w.buttonTextColor,w.buttonTextSize),K=_(),G=_("button","tf-v1-sidetab-close");(w.container||document.body).append(I),C.append(A),I.append(M),I.append(G),M.append(V),M.

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

794It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=function(){if(window.dataLayer){var g=window.dataLayer.find(function(E){return E.length>1&&E[0]==="config"});return g&&g[1]}}()),!_)return void v("the tracking ID could not be retrieved");var y=!1;window.gtag("get",_,"client_id",function(g){y=!0,(0,l.sendGaIdMessage)(h,g,p)}),setTimeout(function(){y||v("the tracker with ID ".concat(_," was not found"))},3e3)}else try{var m=function(g,E){return E?g.find(function(O){return O. ...

795In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c},e:function(c){u=!0,a=c},f:function(){try{o||n.return==null||n.return()}finally{if(u)throw a}}}}function pR(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function Ba(e,t){return Ba=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(n,r){return n.__proto__=r,n},Ba(e,t)}function WL(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Supe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

799 */var jd=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,gR=/\\([\u000b\u0020-\u00ff])/g,bR=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/,_R=wR;function wR(e){if(!e)throw new TypeError("argument string is required");var t=typeof e=="object"?ER(e):e;if(typeof t!="string")throw new TypeError("argument string is required to be a string");var n=t.indexOf(";"),r=n!==-1?t.slice(0,n)

800

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/assets/vendor-a6810c59.jsView file

793L794: It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=functio... L795: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

Findings

2 Medium7 Low

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/vendor-a6810c59.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

800

Long lines were clipped for display.