registry / Telemetry / @hadoku/jobplatform-worker / 2.32.26

@hadoku/jobplatform-worker@2.32.26

Job listings aggregation and tracking dashboard - Worker package

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The worker automatically sends unhandled-error details to its vendor’s telemetry endpoint, with no disclosure or opt-out evident in the package source. This is suspicious runtime telemetry; the inspected credential flows use the worker’s own service key with Hadoku service endpoints.

Static reason

No blocking static signals were detected.

Trigger

An unhandled request error, when the worker has an EDGE binding and HADOKU_SERVICE_KEY.

Impact

The service receives runtime error details without an evident disclosure or opt-out in this package source.

Mechanism

The error handler posts the request method, path, and error message to Hadoku’s telemetry endpoint using HADOKU_SERVICE_KEY.

AI rationale

Evidence

dist/index.js

Network endpoints2

hadoku.me/health/api/telemetryscraper.hadoku.me

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

When the worker has an EDGE binding and HADOKU_SERVICE_KEY, it posts unhandled-error telemetry to Hadoku’s /health/api/telemetry endpoint.
The error report includes the request method and path and the error message; the handler runs this reporting path automatically for unhandled errors.
The package source shows no disclosure or opt-out for this runtime error reporting.

Evidence against

The package is described as a job listings worker, and its company matching route is documented as a read-only proxy to the scraper.
The scraper uses the worker’s HADOKU_SERVICE_KEY and defaults to scraper.hadoku.me; the inspected flow does not show that key sent to an unrelated host.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 207 KB of source, external domains: hadoku.me, job-boards.greenhouse.io, jobs.ashbyhq.com, jobs.lever.co, scraper.hadoku.me

Source & flagged code

3 flagged

dist/index.jsView file

200async function postServiceEvent(env, ev) { const key = env.HADOKU_SERVICE_KEY?.trim(); if (!env.EDGE || !key) throw new Error("EDGE binding or HADOKU_SERVICE_KEY not configured"); const res = await env.EDGE.fetch(`${MONITORING_BASE}/api/telemetry`, { method: "POST", headers: { "C

Medium

Ai Review Evidence

When the worker has an EDGE binding and HADOKU_SERVICE_KEY, it posts unhandled-error telemetry to Hadoku’s /health/api/telemetry endpoint.

dist/index.jsView on unpkg · L200

280if (canPostTelemetry(env)) { runAfterResponse( c, "telemetry: unhandled error", postServiceEvent(env, { level: transient ? "warn" : "error", event: "unhandled_error", message: `${c.req.method} ${c.req.path} ${message ?? err.name}`, context: { method: c.req.method, path: c.req.path,

Medium

Ai Review Evidence

The error report includes the request method and path and the error message; the handler runs this reporting path automatically for unhandled errors.

dist/index.jsView on unpkg · L280

5783app2.onError(errorHandler); return app2; } function createFetchHandler(env) { const app2 = createJobPlatformH

Findings

4 Medium2 Low

MediumNetwork

MediumAi Review Evidencedist/index.js

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @hadoku/jobplatform-worker@2.32.26.

See all versions of @hadoku/jobplatform-worker for other recorded verdicts.

Review the evidence and your use of @hadoku/jobplatform-worker@2.32.26 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 18:51:26.132Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.