registry / @fusengine/harness / 0.1.50

@fusengine/harness@0.1.50

Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable pro

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 55 file(s), 438 KB of source, external domains: code.claude.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/mcp-store-BkBDmuxN.mjsView file

Lines 18-58javascript

18 /^.*was this (helpful|page helpful|article helpful).*$/gim,

21 /^.*subscribe to (our )?newsletter.*$/gim,

22 /^.*follow us on (twitter|facebook|linkedin).*$/gim

23];

24const MAX_BYTES = 5 * 1024;

25function decodeEntities(text) {

26 let out = text;

27 for (const [ent, ch] of Object.entries(HTML_ENTITIES)) out = out.split(ent).join(ch);

28 out = out.replace(/&#x([0-9a-fA-F]+);/g, (_m, h) => String.fromCodePoint(parseInt(h, 16)));

29 out = out.replace(/&#(\d+);/g, (_m, d) => String.fromCodePoint(parseInt(d, 10)));

30 return out;

31}

32/** Strip HTML entities + boilerplate, normalize blank lines, truncate to ~5KB. */

33function compactMarkdown(content) {

34 let text = decodeEntities(content);

35 for (const re of BOILERPLATE) text = text.replace(re, "");

36 text = text.replace(/\n{3,}/g, "\n\n").trim();

37 const enc = new TextEncoder().encode(text);

38 if (enc.length > MAX_BYTES) {

39 const truncated = new TextDecoder().decode(enc.slice(0, MAX_BYTES));

40 text = `${truncated}\n\n[... truncated, ${text.slice(truncated.length).split("\n").length - 1} lines]`;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp-store-BkBDmuxN.mjsView on unpkg · L38

41 }

42 return text;

43}

44/** 8-char MD5 of `${toolName}::${query}`. */

45function queryHash(toolName, query) {

46 return createHash("md5").update(`${toolName}::${query}`).digest("hex").slice(0, 8);

47}

48/** Bag-of-words Jaccard similarity strictly greater than `threshold`. */

49function jaccardSimilar(a, b, threshold = .8) {

50 const ta = new Set(a.toLowerCase().split(/\s+/).filter(Boolean));

51 const tb = new Set(b.toLowerCase().split(/\s+/).filter(Boolean));

52 if (ta.size === 0 || tb.size === 0) return false;

53 let inter = 0;

54 for (const t of ta) if (tb.has(t)) inter++;

55 const union = ta.size + tb.size - inter;

56 return inter / union > threshold;

57}

58//#endregion

dist/handle-DzPjaPS-.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fusengine/harness@0.1.49 matchedIdentity = npm:QGZ1c2VuZ2luZS9oYXJuZXNz:0.1.49 similarity = 0.957 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/handle-DzPjaPS-.mjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/mcp-store-BkBDmuxN.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code