@hadoku/jobplatform-worker@2.32.25
Job listings aggregation and tracking dashboard - Worker package
AI Security Review
scanned 16h ago · by lpm-firewall-aiThe package’s API and service-key use otherwise match its job-platform worker purpose. However, it automatically sends runtime error details to the vendor’s monitoring endpoint, with no disclosure or opt-out evident in the inspected source, so this is suspicious telemetry.
Decision evidence
public snapshot- The worker automatically reports unhandled request errors when its EDGE binding and HADOKU_SERVICE_KEY are configured.
- The report includes the request method and path, error message, and causes.
- Reports go to the package vendor’s Hadoku monitoring endpoint and include the service key in the X-User-Key header.
- The package is described as a job listings aggregation and tracking worker, and its manifest exports a worker entrypoint.
- The service key is also used for the package’s scraper API, consistent with its stated purpose.
Source & flagged code
4 flaggedThe worker automatically reports unhandled request errors when its EDGE binding and HADOKU_SERVICE_KEY are configured.
dist/index.jsView on unpkg · L276The report includes the request method and path, error message, and causes.
dist/index.jsView on unpkg · L283Findings
Affected versions and remediation
This report applies to @hadoku/jobplatform-worker@2.32.25.
See all versions of @hadoku/jobplatform-worker for other recorded verdicts.
- Review the evidence and your use of @hadoku/jobplatform-worker@2.32.25 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.