registry / @hadoku/jobplatform-worker / 2.32.24

@hadoku/jobplatform-worker@2.32.24

Job listings aggregation and tracking dashboard - Worker package

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The worker has no install lifecycle scripts, and the flagged credential flows use the configured Hadoku service key with Hadoku monitoring and scraper endpoints. The inspected telemetry path is gated on the worker's EDGE binding and service key; no unrelated collection or destination was found.

Static reason

No blocking static signals were detected.

Trigger

Runtime requests and unhandled-error reporting when the worker is configured with its service bindings and key.

Impact

No unauthorized credential use or unrelated data collection was identified in the inspected flows.

Mechanism

The worker sends its Hadoku service key to Hadoku monitoring and scraper endpoints for telemetry and scraper requests.

AI rationale

Network endpoints3

hadoku.mescraper.hadoku.meenv.SCRAPER_BASE_URL

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exports the worker entry and lists peer dependencies; it defines no install lifecycle scripts.
Telemetry requires both an EDGE binding and a configured HADOKU_SERVICE_KEY.
The telemetry request sends the configured key to the Hadoku monitoring endpoint.
The scraper client sends HADOKU_SERVICE_KEY to the Hadoku scraper service, using SCRAPER_BASE_URL when configured and scraper.hadoku.me by default.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 207 KB of source, external domains: hadoku.me, job-boards.greenhouse.io, jobs.ashbyhq.com, jobs.lever.co, scraper.hadoku.me

Source & flagged code

6 flagged

package.jsonView file

12"files": [ "dist", "migrations" ], "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } }, "peerDependencies": { "@hono/zod-openapi": ">=1.0.0", "@wolffm/worker-utils": ">=1.5.4", "h

Low

Suspicious Lifecycle Evidence

The manifest exports the worker entry and lists peer dependencies; it defines no install lifecycle scripts.

package.jsonView on unpkg · L12

dist/index.jsView file

197function canPostTelemetry(env) { return Boolean(env?.EDGE && env.HADOKU_SERVICE_KEY?.trim()); } async function postServiceEvent(env, ev) { const key = env.HADOKU_SERVICE_KEY?.t

Low

Ai Review Evidence

Telemetry requires both an EDGE binding and a configured HADOKU_SERVICE_KEY.

dist/index.jsView on unpkg · L197

193const logger = createWorkerLogger({ service: "jobplatform-api" }); var EDGE_BASE = "https://hadoku.me"; var MONITORING_B

Findings

1 Medium8 Low

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencedist/index.js

Affected versions and remediation

This report applies to @hadoku/jobplatform-worker@2.32.24.

See all versions of @hadoku/jobplatform-worker for other recorded verdicts.

Review the evidence and your use of @hadoku/jobplatform-worker@2.32.24 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-03 18:39:50.863Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.