registry / @flarehr/apollo-benefits / 1.4.20641

@flarehr/apollo-benefits@1.4.20641

Flare Benefits

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a browser benefits application that calls its configured application backends and telemetry providers at runtime.

Static reason

No blocking static signals were detected.

Trigger

Browser loads `dist/index.html` and a user authenticates or interacts with the benefits application.

Impact

No install-time mutation, credential/file harvesting, shell execution, remote payload execution, or destructive behavior found.

Mechanism

Preact UI with configured authenticated API/OIDC requests and analytics telemetry.

Rationale

Read-only inspection found a conventional distributed browser application with expected backend, OIDC, analytics, and telemetry behavior. No concrete malicious chain or unconsented install-time control-surface mutation was found.

Evidence

package.jsondist/index.htmldist/config.jsondist/sw-esm.jsdist/assets/index-0c214a5b.jsdist/assets/vendor-a6810c59.jsdist/assets/datadog-8f3e89e5.jsREADME.md

Network endpoints6

cdn.segment.comwww.googletagmanager.comnpm-cdn.flarehr.comwww.flarehr.comwww.datadoghq-browser-agent.comwww.datad0g-browser-agent.com

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no preinstall/install/postinstall hooks; prepare only installs a package-owned Husky hook.
Shipped code is a Preact browser app loaded by `dist/index.html`, not a Node executable.
`dist/config.json` contains application API/OIDC placeholders and Flare content configuration.
Network code in `dist/assets/index-0c214a5b.js` uses configured APIs with authenticated app requests.
`new Function` in `dist/assets/vendor-a6810c59.js` is bundled library/browser global and SVG script handling.
Cookie and beacon calls in `dist/assets/datadog-8f3e89e5.js` are Datadog telemetry behavior.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 1.15 MB of source, external domains: bit.ly, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, docs.datadoghq.com, embed.typeform.com, fb.me, github.com, www.datad0g-browser-agent.com, www.datadoghq-browser-agent.com, www.flarehr.com, www.w3.org

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

779}`;function Mm(){var e=Tm,t=Cm,n=X.cssPrefix,r=X.replacementClass,i=sC;if(n!==e||r!==t){var a=new RegExp("\\.".concat(e,"\\-"),"g"),o=new RegExp("\\--".concat(e,"\\-"),"g"),u=new RegExp("\\.".concat(t),"g");i=i.replace(a,".".concat(n,"-")).replace(o,"--".concat(n,"-")).replace(u,".".concat(r))}return i}var vd=!1;function pu(){X.autoAddCss&&!vd&&(rC(Mm()),vd=!0)}var lC={mixout:function(){return{dom:{css:Mm,insertCss:pu}}},hooks:function(){return{beforeDOMElementCreation:function(){pu()},beforeI2svg:function(){pu()}}}},zt=dn||{};zt[Wt]||(zt[Wt]={});zt[Wt].styles||(zt[Wt].styles={});zt[Wt].hooks| ...

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

781`),e.removeAttribute(n),r()}).catch(i)}else r()}else r()})}function nI(e){return Promise.all([Cd(e,"::before"),Cd(e,"::after")])}function rI(e){return e.parentNode!==document.head&&!~zT.indexOf(e.tagName.toUpperCase())&&!e.getAttribute(ds)&&(!e.parentNode||e.parentNode.tagName!=="svg")}function Id(e){if(Vt)return new Promise(function(t,n){var r=Lr(e.querySelectorAll("*")).filter(rI).map(nI),i=Hl.begin("searchPseudoElements");Gm(),Promise.all(r).then(function(){i(),_s(),t()}).catch(function(){i(),_s(),n()})})}var iI={hooks:function(){return{mutationObserverCallbacks:function(n){return n.pseudoE ...

782In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function SI(e){var t,n=e.beat,r=e.fade,i=e.beatFade,a=e.bounce,o=e.shake,u=e.flash,s=e.spin,c=e.spinPulse,f=e.spinReverse,l=e.pulse,d=e.fixedWidth,v=e.inverse,p=e.border,h=e.listItem,b=e.flip,_=e.size,y=e.rotation,m=e.pull,g=(t

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

788 </svg>`),dt=te==null?void 0:te.startsWith("http");return re.innerHTML=dt?"<img alt='popover trigger icon button' src='".concat(te,"'/>"):te??ge,re.dataset.testid="default-icon",re}(R.customIcon,R.buttonColor||m.buttonColor),K=function(){var te=document.createElement("div");te.className="tf-v1-spinner";var Q=document.createElement("div");return Q.className="tf-v1-popover-button-icon",Q.dataset.testid="spinner-icon",Q.append(te),Q}(),G=y(),x=y("button","tf-v1-popover-close"),U=function(te,Q){Q===void 0&&(Q={});var ae=(0,h.getTextColor)(te),re=document

789 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8

790 </svg>`),ge=H==null?void 0:H.startsWith("http");return ae.innerHTML=ge?"<img alt='popover trigger icon button' src='".concat(H,"'/>"):H??re,ae.dataset.testid="default-icon",ae}(w.customIcon,w.buttonColor||b.buttonColor,w.buttonTextColor,w.buttonTextSize),K=_(),G=_("button","tf-v1-sidetab-close");(w.container||document.body).append(I),C.append(A),I.append(M),I.append(G),M.append(V),M.

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

794It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=function(){if(window.dataLayer){var g=window.dataLayer.find(function(E){return E.length>1&&E[0]==="config"});return g&&g[1]}}()),!_)return void v("the tracking ID could not be retrieved");var y=!1;window.gtag("get",_,"client_id",function(g){y=!0,(0,l.sendGaIdMessage)(h,g,p)}),setTimeout(function(){y||v("the tracker with ID ".concat(_," was not found"))},3e3)}else try{var m=function(g,E){return E?g.find(function(O){return O. ...

795In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c},e:function(c){u=!0,a=c},f:function(){try{o||n.return==null||n.return()}finally{if(u)throw a}}}}function pR(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function Ba(e,t){return Ba=Object.setPrototypeOf?Object.setPrototypeOf.bind():function(n,r){return n.__proto__=r,n},Ba(e,t)}function WL(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Supe ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

799 */var jd=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,gR=/\\([\u000b\u0020-\u00ff])/g,bR=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/,_R=wR;function wR(e){if(!e)throw new TypeError("argument string is required");var t=typeof e=="object"?ER(e):e;if(typeof t!="string")throw new TypeError("argument string is required to be a string");var n=t.indexOf(";"),r=n!==-1?t.slice(0,n)

800

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/assets/vendor-a6810c59.jsView file

793L794: It is also possible the Google Analytics was blocked by your adblock plugin.`)};l.setupGaInstance=function(p,h,b){var _=typeof b=="string"?b:void 0;if(window.gtag){if(_||(_=functio... L795: In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}var a,o=!0,u=!1;return{s:function(){n=n.call(e)},n:function(){var c=n.next();return o=c.done,c}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

Findings

2 Medium7 Low

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/assets/vendor-a6810c59.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

1 flagged

dist/assets/vendor-a6810c59.jsView file

Lines 773-800javascript

773 fill: black;

774}

775

776.fad.fa-inverse,

777.fa-duotone.fa-inverse {

778 color: var(--fa-inverse, #fff);

780`);n.setAttribute(Mn,""),n.innerHTML=o}};function Sd(e){e()}function qm(e,t){var n=typeof t=="function"?t:ca;if(e.length===0)n();else{var r=Sd;X.mutateApproach

783 <path d="M21 0H0V9L10.5743 24V16.5H21C22.6567 16.5 24 15.1567 24 13.5V3C24 1.34325 22.6567 0 21 0ZM7.5

784 9.75C6.672 9.75 6 9.07875 6 8.25C6 7.42125 6.672 6.75 7.5 6.75C8.328 6.75 9 7.42125 9 8.25C9 9.07875 8.328 9.75

785 7.5 9.75ZM12.75 9.75C11.922 9.75 11.25 9.07875 11.25 8.25C11.25 7.42125 11.922 6.75 12.75 6.75C13.578 6.75 14.25

786 7.42125 14.25 8.25C14.25 9.07875 13.578 9.75 12.75 9.75ZM18 9.75C17.172 9.75 16.5 9.07875 16.5 8.25C16.5 7.42125

787 17.172 6.75 18 6.75C18.828 6.75 19.5 7.42125 19.5 8.25C19.5 9.07875 18.828 9.75 18 9.75Z" fill="`.concat(ae,`"></path>

791

792`)+`Make sure to include Google Analytics Javascript code before the Typeform Embed Javascript code in your page and use correct tracker ID.

793

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/vendor-a6810c59.jsView on unpkg · L793

796 * content-type

798 * MIT Licensed

800

Long lines were clipped for display.