registry / @flarehr/apollo-benefits / 1.4.19199

@flarehr/apollo-benefits@1.4.19199

Flare Benefits

AI Security Review

scanned 5h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a browser application with expected authentication, API, analytics, and first-party CDN integrations.

Static reason

No blocking static signals were detected.

Trigger

Browser loads dist/index.html and the application bundle.

Impact

No package-install mutation, credential harvesting, persistence, destructive action, or unconsented control-surface modification found.

Mechanism

Loads browser app configuration, authenticated backend requests, and analytics/first-party UI modules.

Rationale

Source inspection shows a bundled Flare Benefits browser client with normal OIDC bearer-token API use and analytics integrations. No concrete malicious behavior or install-time broad control-surface mutation was found.

Evidence

package.jsondist/index.htmldist/config.jsondist/assets/index-2788a143.jsdist/assets/vendor-a6810c59.jsdist/sw-esm.jsdist/assets/oidc-client-3a9688bc.js

Network endpoints5

www.googletagmanager.com/gtm.js?id=cdn.segment.com/analytics.js/v1/npm-cdn.flarehr.com/@flarehr/salpac-cars-calculator@__ENVIRONMENT/dist/salpac-cars-calculator.jsnpm-cdn.flarehr.com/@flarehr/apollo-customer-workplace-link@__ENVIRONMENT/build/bundle.esm.jsnpm-cdn.flarehr.com/@flarehr/benefits-plan-assessment@__ENVIRONMENT/dist/benefits-plan-assessment.js

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json only defines a prepare hook for Husky setup; no install/preinstall/postinstall hook.
dist/assets/index-2788a143.js is a browser benefits app that loads config and makes bearer-authenticated API requests.
dist/sw-esm.js only unregisters an existing service worker and reloads clients.
No child-process, filesystem, environment-harvesting, or AI-agent-control writes found in package files.
vendor Function calls are bundled dependency code; no concrete payload or attacker-controlled execution chain established.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.15 MB of source, external domains: bit.ly, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, docs.datadoghq.com, embed.typeform.com, fb.me, github.com, www.datad0g-browser-agent.com, www.datadoghq-browser-agent.com, www.flarehr.com, www.w3.org

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

779}`;function Mm(){var e=Tm,t=Cm,n=X.cssPrefix,r=X.replacementClass,i=sC;if(n!==e||r!==t){var a=new RegExp("\\.".concat(e,"\\-"),"g"),o=new RegExp("\\--".concat(e,"\\-"),"g"),u=new RegExp("\\.".concat(t),"g");i=i.replace(a,".".concat(n,"-")).replace(o,"--".concat(n,"-")).replace(u,".".concat(r))}return i}var vd=!1;function pu(){X.autoAddCss&&!vd&&(rC(Mm()),vd=!0)}var lC={mixout:function(){return{dom:{css:Mm,insertCss:pu}}},hooks:function(){return{beforeDOMElementCreation:function(){pu()},beforeI2svg:function(){pu()}}}},zt=dn||{};zt[Wt]||(zt[Wt]={});zt[Wt].styles||(zt[Wt].styles={});zt[Wt].hooks| ...

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

781`),e.removeAttribute(n),r()}).catch(i)}else r()}else r()})}function nI(e){return Promise.all([Cd(e,"::before"),Cd(e,"::after")])}function rI(e){return e.parentNode!==document.head&&!~zT.indexOf(e.tagName.toUpperCase())&&!e.getAttribute(ds)&&(!e.parentNode||e.parentNode.tagName!=="svg")}function Id(e){if(Vt)return new Promise(function(t,n){var r=Lr(e.querySelectorAll("*")).filter(rI).map(nI),i=Hl.begin("searchPseudoElements");Gm(),Promise.all(r).then(function(){i(),_s(),t()}).catch(function(){i(),_s(),n()})})}var iI={hooks:function(){return{mutationObserverCallbacks:function(n){return n.pseudoE ...

782In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function SI(e){var t,n=e.beat,r=e.fade,i=e.beatFade,a=e.bounce,o=e.shake,u=e.flash,s=e.spin,c=e.spinPulse,f=e.spinReverse,l=e.pulse,d=e.fixedWidth,v=e.inverse,p=e.border,h=e.listItem,b=e.flip,_=e.size,y=e.rotation,m=e.pull,g=(t

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

788 </svg>`),dt=te==null?void 0:te.startsWith("http");return re.innerHTML=dt?"<img alt='popover trigger icon button' src='".concat(te,"'/>"):te??ge,re.dataset.testid="default-icon",re}(R.customIcon,R.buttonColor||m.buttonColor),K=function(){var te=document.createElement("div");te.className="tf-v1-spinner";var Q=document.createElement("div");return Q.className="tf-v1-popover-button-icon",Q.dataset.testid="spinner-icon",Q.append(te),Q}(),G=y(),x=y("button","tf-v1-popover-close"),U=function(te,Q){Q===void 0&&(Q={});var ae=(0,h.getTextColor)(te),re=document

789 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8

790 </svg>`),ge=H==null?void 0:H.startsWith("http");return ae.innerHTML=ge?"<img alt='popover trigger icon button' src='".concat(H,"'/>"):H??re,ae.dataset.testid="default-icon",ae}(w.customIcon,w.buttonColor||b.buttonColor,w.buttonTextColor,w.buttonTextSize),K=_(),G=_("button","tf-v1-sidetab-close");(w.container||document.body).append(I),C.append(A),I.append(M),I.append(G),M.append(V),M.

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

794It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=function(){if(window.dataLayer){var g=window.dataLayer.find(function(E){return E.length>1&&E[0]==="config"});return g&&g[1]}}()),!_)return void v("the tracking ID could not be retrieved");var y=!1;window.gtag("get",_,"client_id",function(g){y=!0,(0,l.sendGaIdMessage)(h,g,p)}),setTimeout(function(){y||v("the tracker with ID ".concat(_," was not found"))},3e3)}else try{var m=function(g,E){return E?g.find(function(O){return O. ...

795In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c},e:function(c){u=!0,a=c},f:function(){try{o||n.return==null||n.return()}finally{if(u)throw a}}}}function pR(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function Ba(e,t){return Ba=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(n,r){return n.__proto__=r,n},Ba(e,t)}function WL(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Supe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

799 */var jd=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,gR=/\\([\u000b\u0020-\u00ff])/g,bR=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/,_R=wR;function wR(e){if(!e)throw new TypeError("argument string is required");var t=typeof e=="object"?ER(e):e;if(typeof t!="string")throw new TypeError("argument string is required to be a string");var n=t.indexOf(";"),r=n!==-1?t.slice(0,n)

800

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/assets/vendor-a6810c59.jsView file

793L794: It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=functio... L795: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

Findings

2 Medium7 Low

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/vendor-a6810c59.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

800

Long lines were clipped for display.