registry  /  @flarehr/apollo-benefits  /  1.4.20349

@flarehr/apollo-benefits@1.4.20349

Flare Benefits

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious payload or credential-exfiltration path was established. The install-time surface is limited to a prepare script that invokes Husky after changing to the parent directory.

Static reason
No blocking static signals were detected.
Trigger
npm lifecycle prepare execution; browser application load for runtime requests.
Impact
May configure a repository Git hook when lifecycle scripts are permitted; no concrete malicious behavior found.
Mechanism
prepare-time VCS hook setup and browser API/component loading
Rationale
No malicious chain was confirmed by source inspection. The prepare-time parent-directory Husky setup warrants a warning under the lifecycle-hook policy.
Evidence
package.jsondist/index.htmldist/config.jsondist/assets/index-1688d5fa.jsdist/sw-esm.js
Network endpoints3
www.googletagmanager.com/gtm.js?id=cdn.segment.com/analytics.js/v1/npm-cdn.flarehr.com/

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Benign with medium false-positive risk.
Evidence for warning
  • package.json: prepare runs Husky during installation.
  • prepare changes to parent directory before hook setup.
  • dist/index.html loads external FlareHR component modules at runtime.
Evidence against
  • No preinstall, install, or postinstall hook exists.
  • No Node filesystem, child-process, or AI-agent control writes found in shipped files.
  • dist/assets/index-1688d5fa.js uses configured API/OIDC endpoints for app functions.
  • Network use is browser-runtime API, analytics, authentication, and content delivery.
Behavioral surface
Source
ChildProcessEvalFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 9 file(s), 1.15 MB of source, external domains: bit.ly, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, docs.datadoghq.com, embed.typeform.com, fb.me, github.com, www.datad0g-browser-agent.com, www.datadoghq-browser-agent.com, www.flarehr.com, www.w3.org

Source & flagged code

1 flagged · loading source
dist/assets/vendor-a6810c59.jsView file
793L794: It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=functio... L795: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c}...
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

Findings

2 Medium7 Low
MediumNetwork
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/assets/vendor-a6810c59.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings