registry / @hadoku/jobplatform-worker / 2.32.21

@hadoku/jobplatform-worker@2.32.21

Job listings aggregation and tracking dashboard - Worker package

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The package is a Hadoku job-platform worker, and its network clients use Hadoku service endpoints for feature-specific requests. The inspected entry point exposes a request handler without install-time or automatic startup behavior.

Static reason

No blocking static signals were detected.

Trigger

A host invokes the exported request handler, and a matching route calls the relevant service client.

Impact

Expected job-platform service requests; no unrelated collection or concealed execution was found in the inspected entry point.

Mechanism

The clients send the configured Hadoku service key and feature-specific requests to Hadoku endpoints, or to a base URL explicitly configured in the worker environment.

AI rationale

Network endpoints3

hadoku.me/contact/api/mailfeedscraper.hadoku.mehadoku.me

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest identifies this as Hadoku’s job listings worker package.
The mail feed client sends HADOKU_SERVICE_KEY to Hadoku’s mail feed endpoint, using a service binding by default or an explicitly configured base URL.
The scraper client uses Hadoku’s scraper endpoint by default and requires HADOKU_SERVICE_KEY for requests.
The exported handler processes requests when the host invokes it; the inspected entry point shows no install hook or automatic startup task.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 202 KB of source, external domains: hadoku.me, job-boards.greenhouse.io, jobs.ashbyhq.com, jobs.lever.co, scraper.hadoku.me

Source & flagged code

4 flagged

package.jsonView file

2"name": "@hadoku/jobplatform-worker", "version": "2.32.21", "gitHead": "[redacted]", "description": "Job listings aggregation and tracking das

Low

Ai Review Evidence

The manifest identifies this as Hadoku’s job listings worker package.

package.jsonView on unpkg · L2

dist/index.jsView file

832Routes = app$5; const DEFAULT_BASE_URL$1 = "https://hadoku.me/contact/api/mailfeed"; function baseUrl$1(env) { return (env.MAILFEED_BASE_URL ?? DEFAULT_BASE_URL$1).replace(/\/$/, ""); } function feedFetch(env, url, init) { if (env.MAILFEED_BASE_URL) return fetch(url, init); if (!env.EDGE) throw new Error("EDGE service binding not configured"); return env.EDGE.fetch(url, init); } async function get(env, path) { const key = env.HADOKU_SERVICE_KEY; if (!key) return { error: "HADOKU_SERVICE_KEY is not bound — cannot read the

Low

Ai Review Evidence

The mail feed client sends HADOKU_SERVICE_KEY to Hadoku’s mail feed endpoint, using a service binding by default or an explicitly configured base URL.

dist/index.jsView on unpkg · L832

Findings

1 Medium6 Low

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencepackage.json

LowAi Review Evidencedist/index.js

LowSuspicious Lifecycle Evidencedist/index.js

Affected versions and remediation

This report applies to @hadoku/jobplatform-worker@2.32.21.

See all versions of @hadoku/jobplatform-worker for other recorded verdicts.

Review the evidence and your use of @hadoku/jobplatform-worker@2.32.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-02 22:15:58.595Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.