Loading npm security reports…

@fusengine/harness@0.1.45: Suspicious npm security report (Warn) | LPM Firewall

registry / @fusengine/harness / 0.1.45

@fusengine/harness@0.1.45

Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable pro

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious behavior, but the default CLI check contains a shell-injection risk through staged filenames. A malicious repository could exploit a crafted filename when a user runs `harness`/`harness check` in that repo.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the CLI default check in a repository containing a crafted staged filename.

Impact

possible local command execution under the invoking user

Mechanism

shell command construction with unescaped filename in execSync

Attack narrative

The package is an AI-agent harness and policy CLI. Its hook installation and local state writes match that purpose and are user-invoked, not install-time. The unresolved risk is a real shell-injection bug in the staged-file checker: a crafted staged path is interpolated into `git show` via shell-backed execSync.

Rationale

Source inspection does not support a malicious verdict, but the CLI contains an exploitable command-construction flaw reachable in normal use against an attacker-controlled repository. Treat as warning for critical vulnerability risk rather than publish block for malware.

Evidence

package.jsondist/cli/bin.mjsdist/run-DLXtA5DH.mjsdist/run-Do2JltgU.mjsdist/handle-DJaaD2BT.mjs.claude/settings.json.codex/hooks.json.cursor/hooks.json.gemini/settings.json.clinerules/hooks/PreToolUse.clinerules/hooks/PostToolUse

Source & flagged code

2 flagged

dist/mcp-store-BkBDmuxN.mjsView file

Lines 18-58javascript

18 /^.*was this (helpful|page helpful|article helpful).*$/gim,

19 /^.*©\s*\d{4}.*all rights reserved.*$/gim,

20 /^\s*(home|about|contact|privacy|terms)\s*\|\s*.*$/gim,

21 /^.*subscribe to (our )?newsletter.*$/gim,

22 /^.*follow us on (twitter|facebook|linkedin).*$/gim

23];

24const MAX_BYTES = 5 * 1024;

25function decodeEntities(text) {

26 let out = text;

27 for (const [ent, ch] of Object.entries(HTML_ENTITIES)) out = out.split(ent).join(ch);

28 out = out.replace(/&#x([0-9a-fA-F]+);/g, (_m, h) => String.fromCodePoint(parseInt(h, 16)));

29 out = out.replace(/&#(\d+);/g, (_m, d) => String.fromCodePoint(parseInt(d, 10)));

30 return out;

31}

32/** Strip HTML entities + boilerplate, normalize blank lines, truncate to ~5KB. */

33function compactMarkdown(content) {

34 let text = decodeEntities(content);

35 for (const re of BOILERPLATE) text = text.replace(re, "");

36 text = text.replace(/\n{3,}/g, "\n\n").trim();

37 const enc = new TextEncoder().encode(text);

38 if (enc.length > MAX_BYTES) {

39 const truncated = new TextDecoder().decode(enc.slice(0, MAX_BYTES));

40 text = `${truncated}\n\n[... truncated, ${text.slice(truncated.length).split("\n").length - 1} lines]`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp-store-BkBDmuxN.mjsView on unpkg · L38

41 }

42 return text;

43}

44/** 8-char MD5 of `${toolName}::${query}`. */

45function queryHash(toolName, query) {

46 return createHash("md5").update(`${toolName}::${query}`).digest("hex").slice(0, 8);

47}

48/** Bag-of-words Jaccard similarity strictly greater than `threshold`. */

49function jaccardSimilar(a, b, threshold = .8) {

50 const ta = new Set(a.toLowerCase().split(/\s+/).filter(Boolean));

51 const tb = new Set(b.toLowerCase().split(/\s+/).filter(Boolean));

52 if (ta.size === 0 || tb.size === 0) return false;

53 let inter = 0;

54 for (const t of ta) if (tb.has(t)) inter++;

55 const union = ta.size + tb.size - inter;

56 return inter / union > threshold;

57}

58//#endregion

dist/handle-DJaaD2BT.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fusengine/harness@0.1.44 matchedIdentity = npm:QGZ1c2VuZ2luZS9oYXJuZXNz:0.1.44 similarity = 0.891 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/handle-DJaaD2BT.mjsView on unpkg