Loading npm security reports…

@harperfast/harper: Suspicious npm security report (Warn) | LPM Firewall

registry / @harperfast/harper / 5.1.22

@harperfast/harper@5.1.22

⚠ Under review

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 911 file(s), 18.1 MB of source, external domains: api.anthropic.com, api.example.com, api.openai.com, bit.ly, bugzilla.mozilla.org, cdn.jsdelivr.net, chevrotain.io, code.google.com, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, dashboard.stripe.com, data.jsdelivr.com, datatracker.ietf.org, developer.mozilla.org, developers.google.com, discord.com, discord.gg, docs.datadoghq.com, docs.harperdb.io, drafts.csswg.org, en.wikipedia.org, example.com, fabric.harper.fast, fb.me, github.com, google.com, googlechrome.github.io, hacks.mozilla.org, harper.fast, harperdb.io, harperdbhelp.zendesk.com, help.yahoo.com, html.spec.whatwg.org, instagram.com, js.stripe.com, json-schema.org, langium.org, node.example.com, official-joke-api.appspot.com, prettier.io, r12a.github.io, raw.githubusercontent.com, react.dev, redux-toolkit.js.org, redux.js.org, sass-lang.com, schema.org, soundcloud.com, spdx.org, spec.openapis.org

Source & flagged code

11 flagged · loading source

dist/utility/terms/certificates.jsView file

4patternName = private_key_rsa severity = critical line = 4 matchedText = key: '--...0)),

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/utility/terms/certificates.jsView on unpkg · L4

4patternName = private_key_rsa severity = critical line = 4 matchedText = key: '--...0)),

Critical

Secret Pattern

RSA private key in dist/utility/terms/certificates.js

dist/utility/terms/certificates.jsView on unpkg · L4

upgrade/directives/5-1-0.tsView file

39const CreateTableObject = L40: require('../../dataLayer/CreateTableObject').default || require('../../dataLayer/CreateTableObject'); L41: const schema = (systemSchema as any)[DEPLOYMENT_TABLE];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

upgrade/directives/5-1-0.tsView on unpkg · L39

dist/resources/graphql.jsView file

1"use strict"; L2: var __importDefault = (this && this.__importDefault) || function (mod) {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/resources/graphql.jsView on unpkg · L1

dist/agent/tools/httpFetchTool.jsView file

10exports.httpFetchTool = void 0; L11: const node_net_1 = require("node:net"); L12: const MAX_BYTES = 2 * 1024 * 1024; // 2 MiB cap on response bodies ... L32: headers: { type: 'object', additionalProperties: { type: 'string' } }, L33: body: { type: 'string', description: 'Request body as a string (JSON or form-encoded).' }, L34: timeoutMs: { type: 'integer', minimum: 1, maximum: 120_000 }, ... L72: headers: Object.fromEntries(response.headers.entries()), L73: body: buffer.toString('utf8'), L74: truncated: buffer.length === MAX_BYTES,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/agent/tools/httpFetchTool.jsView on unpkg · L10

studio/web/assets/yaml.worker-DZpdto5S.jsView file

115contains invisible/control Unicode U+FEFF (zero width no-break space) `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var ff=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

studio/web/assets/yaml.worker-DZpdto5S.jsView on unpkg · L115

utility/scripts/user_data.shView file

•path = utility/scripts/user_data.sh kind = build_helper sizeBytes = 427 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utility/scripts/user_data.shView on unpkg

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView file

•path = [redacted]-Bold-DDaUYG8E.woff kind = high_entropy_blob sizeBytes = 24936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView on unpkg

studio/web/assets/ts.worker-CV4Qyelf.jsView file

•path = studio/web/assets/ts.worker-CV4Qyelf.js kind = oversized_source_file sizeBytes = 6895185 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/web/assets/ts.worker-CV4Qyelf.jsView on unpkg

bin/cliOperations.tsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = harper@5.1.20 matchedPath = bin/cliCredentials.ts matchedIdentity = npm:aGFycGVy:5.1.20 similarity = 1.000 shingleOverlap = 80 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/cliOperations.tsView on unpkg

utility/terms/certificates.jsView file

8patternName = private_key_rsa severity = critical line = 8 matchedText = key: '--...ace(

Critical

Secret Pattern

RSA private key in utility/terms/certificates.js

utility/terms/certificates.jsView on unpkg · L8

Source & flagged code

11 flagged

dist/utility/terms/certificates.jsView file

Lines 1-24javascript

1'use strict';

2const CERTIFICATE_VALUES = {

3 cert: '-----BEGIN CERTIFICATE-----\rMIIDXDCCAkSgAwIBAgIFNTE4MzQwDQYJKoZIhvcNAQELBQAwXTEXMBUGA1UEAxMO\rSGFycGVyREIsIEluYy4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UE\rBxMGRGVudmVyMRcwFQYDVQQKEw5IYXJwZXJEQiwgSW5jLjAeFw0yMjAzMTEyMzAz\rNDlaFw0yNzAzMTAyMzAzNDlaMF0xFzAVBgNVBAMTDkhhcnBlckRCLCBJbmMuMQsw\rCQYDVQQGEwJVUzELMAkGA1UECBMCQ08xDzANBgNVBAcTBkRlbnZlcjEXMBUGA1UE\rChMOSGFycGVyREIsIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\rAQCsEUlBF8WImS78rCFXVKyntxfrW++4qZ3hGnoD2MHZAuDHyeP/5eGnaE9GQhKc\r4DwG4DGvh0wP2zIYnBfiQ3L2ZtnlDR9ZkKIQYGlVxTUn6T43krhK5nZKqDF43Yg3\rZEvO3cbJBjiKZx0eA2/toehdSsTAHHQx ...

4 key: '-----BEGIN RSA PRIVATE KEY-----\rMIIEowIBAAKCAQEArBFJQRfFiJku/KwhV1Ssp7cX61vvuKmd4Rp6A9jB2QLgx8nj\r/+Xhp2hPRkISnOA8BuAxr4dMD9syGJwX4kNy9mbZ5Q0fWZCiEGBpVcU1J+k+N5K4\rSuZ2SqgxeN2IN2RLzt3GyQY4imcdHgNv7aHoXUrEwBx0MeYEw3IIDXtrYKCR2D8I\rvWBfwMUgWa24G8lpWILWA5hd9srRz9NxlAiHSjhbgT7B0xruEpHRCHSyKjvaIJVt\rWBR+amejYsAKVrD/hgrqjsA1123Y6++YqvU6vwg64xhS2kz5r3dkNKhvwbWgpZdI\rIaRvsiB77f4kLGo0vi8RFgJ1ZRjGg3RRK2w1LQIDAQABAoIBAQCEOmh78EOpnGZC\rYBjjHrvrysVD5gvLcfVUtl8Ls7gMB60re1eOIF+PoZZCHKZnDd6zPfiQtj1adg0C\rYnnsM/8VoaZS4gm0b3RLd3ubIQifWhuo40RissY2yxfxlPSH9LhZCY8ojnJG0cTL\resK579E8WCfopjUY33XLqEbN7Ylv3 ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/utility/terms/certificates.jsView on unpkg · L4

Critical

Secret Pattern

RSA private key in dist/utility/terms/certificates.js

5};

6const CERTIFICATE_PEM_NAME = 'certificate.pem';

7const PRIVATEKEY_PEM_NAME = 'privateKey.pem';

8const CA_PEM_NAME = 'caCertificate.pem';

9const CERT_NAME = {

10 'DEFAULT': 'default',

11 'DEFAULT-CA': 'default-ca',

12 'SERVER': 'server',

13 'CA': 'ca',

14 'OPERATIONS-API': 'operations-api',

15 'OPERATIONS-CA': 'operations-ca',

16};

17const CERT_CONFIG_NAME_MAP = {

18 tls_certificate: CERT_NAME.SERVER,

19 tlsCertificateAuthority: CERT_NAME.CA,

20 customFunctions_tls_certificate: CERT_NAME.SERVER,

21 customFunctionsTlsCertificateAuthority: CERT_NAME.CA,

22 operationsApi_tls_certificate: CERT_NAME['OPERATIONS-API'],

23 operationsApiTlsCertificateAuthority: CERT_NAME['OPERATIONS-CA'],

24};

Long lines were clipped for display.

upgrade/directives/5-1-0.tsView file

Lines 19-59typescript

19import * as terms from '../../utility/hdbTerms.ts';

20import * as initPaths from '../../dataLayer/harperBridge/lmdbBridge/lmdbUtility/initializePaths.js';

21import bridge from '../../dataLayer/harperBridge/harperBridge.ts'

dist/resources/graphql.jsView file

Lines 1-21javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/resources/graphql.jsView on unpkg · L1

3 return

dist/agent/tools/httpFetchTool.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * `http_fetch` for the built-in agent (#626). Wraps the platform `fetch`

4 * with a size cap, an inactivity timeout, and a metadata/loopback blocklist

5 * so the agent can probe its own deployed components and pull lightweight

6 * web pages for context without becoming an SSRF vector against cloud

7 * instance-metadata endpoints or unrelated internal services.

8 */

9Object.defineProperty(exports

studio/web/assets/yaml.worker-DZpdto5S.jsView file

115contains invisible/control Unicode U+FEFF (zero width no-break space) `)+(a.substring(1)||` `),n=!0,r=!1;break;case`%`:e[i+1]?.[0]!==`#`&&(i+=1),n=!1;break;default:n||(r=!0),n=!1}}return{comment:t,afterEmptyLine:r}}var ff=class{constructor(e={}){this.doc=null,this.atDirectives=!1,this.prelude=[],this.errors=[

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

studio/web/assets/yaml.worker-DZpdto5S.jsView on unpkg · L115

utility/scripts/user_data.shView file

•path = utility/scripts/user_data.sh kind = build_helper sizeBytes = 427 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utility/scripts/user_data.shView on unpkg

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView file

•path = [redacted]-Bold-DDaUYG8E.woff kind = high_entropy_blob sizeBytes = 24936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView on unpkg

studio/web/assets/ts.worker-CV4Qyelf.jsView file

•path = studio/web/assets/ts.worker-CV4Qyelf.js kind = oversized_source_file sizeBytes = 6895185 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/web/assets/ts.worker-CV4Qyelf.jsView on unpkg

bin/cliOperations.tsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = harper@5.1.20 matchedPath = bin/cliCredentials.ts matchedIdentity = npm:aGFycGVy:5.1.20 similarity = 1.000 shingleOverlap = 80 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/cliOperations.tsView on unpkg

utility/terms/certificates.jsView file

Lines 1-28javascript

1'use strict';

2

3const CERTIFICATE_VALUES = {

4 cert: '-----BEGIN CERTIFICATE-----\rMIIDXDCCAkSgAwIBAgIFNTE4MzQwDQYJKoZIhvcNAQELBQAwXTEXMBUGA1UEAxMO\rSGFycGVyREIsIEluYy4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UE\rBxMGRGVudmVyMRcwFQYDVQQKEw5IYXJwZXJEQiwgSW5jLjAeFw0yMjAzMTEyMzAz\rNDlaFw0yNzAzMTAyMzAzNDlaMF0xFzAVBgNVBAMTDkhhcnBlckRCLCBJbmMuMQsw\rCQYDVQQGEwJVUzELMAkGA1UECBMCQ08xDzANBgNVBAcTBkRlbnZlcjEXMBUGA1UE\r