registry / @flarehr/apollo-benefits / 1.4.18766

@flarehr/apollo-benefits@1.4.18766

Flare Benefits

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious npm install/import attack surface was found. Runtime network behavior is a browser benefits app using configured Flare APIs, OIDC, analytics, Contentful, and Flare-owned CDN modules.

Static reason

No blocking static signals were detected.

Trigger

Browser loads dist/index.html or app routes after deployment; prepare runs only during package development/VCS install.

Impact

No evidence of credential harvesting, shell execution, persistence, destructive behavior, or unconsented agent control-surface mutation.

Mechanism

Vite-built Preact web application with OIDC auth and analytics

Rationale

Static inspection shows a packaged browser application with expected Flare Benefits API calls and third-party analytics, not install-time malware. The prepare hook is a husky development hook and there is no concrete exfiltration, shell execution, persistence, or broad AI-agent config mutation.

Evidence

package.jsondist/index.htmldist/config.jsondist/sw-esm.jsdist/assets/index-e900c0ab.jsdist/assets/datadog-0aa35f8a.js

Network endpoints8

www.flarehr.com/cars/calculatorwww.googletagmanager.com/gtm.jswww.googletagmanager.com/ns.htmlcdn.segment.com/analytics.js/v1/npm-cdn.flarehr.com/@flarehr/salpac-cars-calculator@__ENVIRONMENT/dist/salpac-cars-calculator.jsnpm-cdn.flarehr.com/@flarehr/apollo-customer-workplace-link@__ENVIRONMENT/build/bundle.esm.jsnpm-cdn.flarehr.com/@flarehr/benefits-plan-assessment@__ENVIRONMENT/dist/benefits-plan-assessment.jsdatadoghq.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall; only prepare runs husky install for local VCS hooks.
Published files are dist web app assets, config, manifest, icons, and service worker; no Node entrypoint or bin.
dist/index.html loads Flare-owned npm-cdn modules plus Google Tag Manager and Segment analytics.
dist/config.json contains Flare app configuration, Contentful public API key, and cars calculator URL.
dist/assets/index-e900c0ab.js uses configured Flare backend APIs with bearer auth for normal app workflows.
dist/sw-esm.js only unregisters the current service worker and navigates existing clients.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.15 MB of source, external domains: bit.ly, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, docs.datadoghq.com, embed.typeform.com, fb.me, github.com, www.datad0g-browser-agent.com, www.datadoghq-browser-agent.com, www.flarehr.com, www.w3.org

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

779}`;function Mm(){var e=Tm,t=Cm,n=X.cssPrefix,r=X.replacementClass,i=sC;if(n!==e||r!==t){var a=new RegExp("\\.".concat(e,"\\-"),"g"),o=new RegExp("\\--".concat(e,"\\-"),"g"),u=new RegExp("\\.".concat(t),"g");i=i.replace(a,".".concat(n,"-")).replace(o,"--".concat(n,"-")).replace(u,".".concat(r))}return i}var vd=!1;function pu(){X.autoAddCss&&!vd&&(rC(Mm()),vd=!0)}var lC={mixout:function(){return{dom:{css:Mm,insertCss:pu}}},hooks:function(){return{beforeDOMElementCreation:function(){pu()},beforeI2svg:function(){pu()}}}},zt=dn||{};zt[Wt]||(zt[Wt]={});zt[Wt].styles||(zt[Wt].styles={});zt[Wt].hooks| ...

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

781`),e.removeAttribute(n),r()}).catch(i)}else r()}else r()})}function nI(e){return Promise.all([Cd(e,"::before"),Cd(e,"::after")])}function rI(e){return e.parentNode!==document.head&&!~zT.indexOf(e.tagName.toUpperCase())&&!e.getAttribute(ds)&&(!e.parentNode||e.parentNode.tagName!=="svg")}function Id(e){if(Vt)return new Promise(function(t,n){var r=Lr(e.querySelectorAll("*")).filter(rI).map(nI),i=Hl.begin("searchPseudoElements");Gm(),Promise.all(r).then(function(){i(),_s(),t()}).catch(function(){i(),_s(),n()})})}var iI={hooks:function(){return{mutationObserverCallbacks:function(n){return n.pseudoE ...

782In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function SI(e){var t,n=e.beat,r=e.fade,i=e.beatFade,a=e.bounce,o=e.shake,u=e.flash,s=e.spin,c=e.spinPulse,f=e.spinReverse,l=e.pulse,d=e.fixedWidth,v=e.inverse,p=e.border,h=e.listItem,b=e.flip,_=e.size,y=e.rotation,m=e.pull,g=(t

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

788 </svg>`),dt=te==null?void 0:te.startsWith("http");return re.innerHTML=dt?"<img alt='popover trigger icon button' src='".concat(te,"'/>"):te??ge,re.dataset.testid="default-icon",re}(R.customIcon,R.buttonColor||m.buttonColor),K=function(){var te=document.createElement("div");te.className="tf-v1-spinner";var Q=document.createElement("div");return Q.className="tf-v1-popover-button-icon",Q.dataset.testid="spinner-icon",Q.append(te),Q}(),G=y(),x=y("button","tf-v1-popover-close"),U=function(te,Q){Q===void 0&&(Q={});var ae=(0,h.getTextColor)(te),re=document

789 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8

790 </svg>`),ge=H==null?void 0:H.startsWith("http");return ae.innerHTML=ge?"<img alt='popover trigger icon button' src='".concat(H,"'/>"):H??re,ae.dataset.testid="default-icon",ae}(w.customIcon,w.buttonColor||b.buttonColor,w.buttonTextColor,w.buttonTextSize),K=_(),G=_("button","tf-v1-sidetab-close");(w.container||document.body).append(I),C.append(A),I.append(M),I.append(G),M.append(V),M.

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

794It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=function(){if(window.dataLayer){var g=window.dataLayer.find(function(E){return E.length>1&&E[0]==="config"});return g&&g[1]}}()),!_)return void v("the tracking ID could not be retrieved");var y=!1;window.gtag("get",_,"client_id",function(g){y=!0,(0,l.sendGaIdMessage)(h,g,p)}),setTimeout(function(){y||v("the tracker with ID ".concat(_," was not found"))},3e3)}else try{var m=function(g,E){return E?g.find(function(O){return O. ...

795In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c},e:function(c){u=!0,a=c},f:function(){try{o||n.return==null||n.return()}finally{if(u)throw a}}}}function pR(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function Ba(e,t){return Ba=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(n,r){return n.__proto__=r,n},Ba(e,t)}function WL(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Supe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

799 */var jd=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,gR=/\\([\u000b\u0020-\u00ff])/g,bR=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/,_R=wR;function wR(e){if(!e)throw new TypeError("argument string is required");var t=typeof e=="object"?ER(e):e;if(typeof t!="string")throw new TypeError("argument string is required to be a string");var n=t.indexOf(";"),r=n!==-1?t.slice(0,n)

800

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/assets/vendor-a6810c59.jsView file

793L794: It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=functio... L795: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

Findings

2 Medium7 Low

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/vendor-a6810c59.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

800

Long lines were clipped for display.