registry / @hadoku/jobplatform-worker / 2.32.22
@hadoku/jobplatform-worker@2.32.22
Job listings aggregation and tracking dashboard - Worker package
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest identifies a job-platform worker, and the flagged key flows send its service key to Hadoku endpoints for matching, search, mail feed, and resume features. The inspected requests are feature-triggered, with no unrelated credential destination or install-time behavior found.
Static reason
No blocking static signals were detected.
Trigger
Requests to the worker’s job board, mail feed, or resume features; search may also be triggered after adding a company to a profile.
Impact
Expected service requests for job listings, mail feed data, and resume features; no unrelated credential destination or automatic install-time behavior was identified.
Mechanism
The worker uses HADOKU_SERVICE_KEY with Hadoku service endpoints. Base URL overrides are supplied through environment configuration.
AI rationale
The manifest identifies a job-platform worker, and the flagged key flows send its service key to Hadoku endpoints for matching, search, mail feed, and resume features. The inspected requests are feature-triggered, with no unrelated credential destination or install-time behavior found.
Network endpoints2
scraper.hadoku.mehadoku.me
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a job listings worker and exports its compiled handler.
- The worker sends its configured HADOKU_SERVICE_KEY to the Hadoku scraper service for job board operations; the scraper base URL can be explicitly configured.
- Mail feed access uses the same service key with the Hadoku mail feed endpoint or an explicitly configured base URL.
- Scraper searches are triggered by application routes, including after a company is added to a profile.
- The scheduled handler only logs the cron event; it does not make a scraper or mail feed request.
Evidence against
- The source uses network requests and contains service-key handling, but the inspected flows send the Hadoku service key to Hadoku service endpoints.
- No install lifecycle scripts are declared in the package manifest.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
2"name": "@hadoku/jobplatform-worker",
"version": "2.32.22",
"gitHead": "[redacted]",
"description": "Job listings aggregation and tracking dashboard - Worker package",
"l
Low
Ai Review Evidence
The manifest describes a job listings worker and exports its compiled handler.
package.jsonView on unpkg · L2dist/index.jsView file
2478const DEFAULT_BASE_URL = "https://scraper.hadoku.me";
class ScraperClientError extends Error {
status;
body;
constructor(message, status, body) {
super(message);
this.name = "ScraperClientError";
this.status = status;
this.body = body;
}
}
function baseUrl(env) {
return env.SCRAPER_BASE_URL ?? DEFAULT_B
Low
Ai Review Evidence
The worker sends its configured HADOKU_SERVICE_KEY to the Hadoku scraper service for job board operations; the scraper base URL can be explicitly configured.
dist/index.jsView on unpkg · L24782496const url = `${baseUrl(env)}${path}`;
return fetch(url, {
method: init.method,
body: init.body,
headers: {
"Content-Type": "application/json",
"X-User-K
Findings
1 Medium8 Low
MediumNetwork
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
Affected versions and remediation
This report applies to @hadoku/jobplatform-worker@2.32.22.
See all versions of @hadoku/jobplatform-worker for other recorded verdicts.
- Review the evidence and your use of @hadoku/jobplatform-worker@2.32.22 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.