registry / @hadoku/jobplatform-worker / 2.32.18

@hadoku/jobplatform-worker@2.32.18

Job listings aggregation and tracking dashboard - Worker package

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The package exports an authenticated worker API and has no install hook. The flagged network and credential references serve its mail-feed, scraper, and resume integrations; no unrelated credential destination or automatic attack behavior was found.

Static reason

No blocking static signals were detected.

Trigger

Authenticated API requests handled by the host worker; the package declares no install lifecycle scripts.

Impact

Expected service requests and processing of job or mailbox data for the requested features; no unrelated collection or automatic harmful action was identified.

Mechanism

Feature handlers call Hadoku mail-feed and scraper APIs with the configured service key, or a configured resume service binding with its edge secret.

AI rationale

Network endpoints4

hadoku.me/contact/api/mailfeedhadoku.me/session/identity/resolvescraper.hadoku.me/api/v1/jobboards/proberesume-api service binding

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest describes a job platform worker and exports its handler from dist/index.js; no lifecycle scripts are declared.
Mail-feed requests send HADOKU_SERVICE_KEY to the Hadoku mail-feed endpoint; reading verification messages is restricted to an authenticated admin and checked against the mailbox owner.
The scraper client sends HADOKU_SERVICE_KEY to the Hadoku scraper service for its job-platform API requests.
Resume requests use a configured RESUME service binding and pass its edge secret to the resume API.
The worker applies edge-auth middleware to its API routes.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 202 KB of source, external domains: hadoku.me, job-boards.greenhouse.io, jobs.ashbyhq.com, jobs.lever.co, scraper.hadoku.me

Source & flagged code

8 flagged

package.jsonView file

1{ "name": "@hadoku/jobplatform-worker", "version": "2.32.18", "gitHead": "[redacted]", "description": "Job listings aggregation and tracking dashboard - Worker package", "license": "MIT", "type": "module", "repository": { "type": "git", "url": "git+https://github.com/WolffM/hadoku-jobplatform.git" }, "files": [ "dist", "migrations" ], "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } }, "peerDependencies": { "@hono/zod-openapi": ">=1.0.0", "@wolffm/worker-utils": "

Low

Suspicious Lifecycle Evidence

The manifest describes a job platform worker and exports its handler from dist/index.js; no lifecycle scripts are declared.

package.jsonView on unpkg · L1

dist/index.jsView file

838const key = env.HADOKU_SERVICE_KEY; if (!key) return { error: "HADOKU_SERVICE_KEY is not bound — cannot read the mail feed" }; let res; try { res = await fetch(`${baseUrl$1(env)}${path}`, { headers: { "X-User-Key": key } }); } catch (err) {

Low

Ai Review Evidence

Mail-feed requests send HADOKU_SERVICE_KEY to the Hadoku mail-feed endpoint; reading verification messages is restricted to an authenticated admin and checked against the mailbox owner.

Findings

1 Medium10 Low

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @hadoku/jobplatform-worker@2.32.18.

See all versions of @hadoku/jobplatform-worker for other recorded verdicts.

Review the evidence and your use of @hadoku/jobplatform-worker@2.32.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-02 06:43:29.372Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.