registry / @hadoku/jobplatform-worker / 2.32.16

@hadoku/jobplatform-worker@2.32.16

Job listings aggregation and tracking dashboard - Worker package

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The package exports a job platform worker, and inspected network calls serve its mail, scraper, identity, and resume functions. Service credentials are sent to those configured or package-owned services, with no evidence of unrelated collection or install-time activity.

Static reason

No blocking static signals were detected.

Trigger

Requests to the worker's API routes.

Impact

Expected service operations for the worker; no unrelated credential collection or automatic outbound action was found.

Mechanism

Configured service credentials go to Hadoku service endpoints; resume requests use a service binding and authenticated routes.

AI rationale

Evidence

dist/index.js

Network endpoints4

hadoku.me/contact/api/mailfeedhadoku.me/session/identity/resolvescraper.hadoku.meresume-api

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package describes itself as a job platform worker and exports a request handler.
Mail-feed and scraper requests use the configured HADOKU_SERVICE_KEY with the package's Hadoku services.
Resume-generation requests use a configured service binding and are registered behind authentication.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 201 KB of source, external domains: hadoku.me, job-boards.greenhouse.io, jobs.ashbyhq.com, jobs.lever.co, scraper.hadoku.me

Source & flagged code

5 flagged

package.jsonView file

2"name": "@hadoku/jobplatform-worker", "version": "2.32.16", "description": "Job listings aggregation and tracking dashboard - Worker package", "license": "MIT",

Low

Ai Review Evidence

The package describes itself as a job platform worker and exports a request handler.

package.jsonView on unpkg · L2

dist/index.jsView file

839ot read the mail feed" }; let res; try { res = await fetch(`${baseUrl$1(env)}${path}`, { headers: { "X-User-Key": key } }); } catch (err) { return { error: `mail feed unreachable: ${err

Low

Ai Review Evidence

Mail-feed and scraper requests use the configured HADOKU_SERVICE_KEY with the package's Hadoku services.

dist/index.jsView on unpkg · L839

2485url = `${baseUrl(env)}${path}`; return fetch(url, { method: init.method, body: init.body, headers: { "Content-Type": "application/json", "X-User-Key": env.HADOKU_SERVICE_KEY

Findings

1 Medium7 Low

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @hadoku/jobplatform-worker@2.32.16.

See all versions of @hadoku/jobplatform-worker for other recorded verdicts.

Review the evidence and your use of @hadoku/jobplatform-worker@2.32.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-01 23:25:03.437Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.