@harperfast/harper-pro@5.1.19: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@harperfast/harper-pro@5.1.19: Clean npm security report (Allow) | LPM Firewall

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hook.
dist/bin/harper.js only runs when the user invokes the harper CLI.
core/agent/tools/httpFetchTool.ts blocks cloud metadata hosts and IPv4 link-local addresses.
core/utility/terms/certificates.js contains a bundled TLS development key; core/security/keys.ts uses certificate material for local TLS handling.
core/upgrade/directives/5-1-0.ts uses a static fallback require for a database upgrade object, not remote loading.
studio/web/assets/html.worker-CaVO4r1v.js is a minified editor asset whose Unicode matches are entity data, not hidden control flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 929 file(s), 18.8 MB of source, external domains: api.anthropic.com, api.example.com, api.github.com, api.openai.com, bit.ly, bugzilla.mozilla.org, cdn.jsdelivr.net, chevrotain.io, code.google.com, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, data.jsdelivr.com, datatracker.ietf.org, developer.mozilla.org, developers.google.com, discord.com, discord.gg, docs.datadoghq.com, docs.harperdb.io, drafts.csswg.org, en.wikipedia.org, example.com, fabric.harper.fast, fb.me, github.com, google.com, googlechrome.github.io, hacks.mozilla.org, harper.fast, harperdb.io, harperdbhelp.zendesk.com, help.yahoo.com, html.spec.whatwg.org, instagram.com, js.stripe.com, json-schema.org, langium.org, node.example.com, official-joke-api.appspot.com, prettier.io, r12a.github.io, raw.githubusercontent.com, react.dev, redux-toolkit.js.org, redux.js.org, sass-lang.com, schema.org, soundcloud.com, spdx.org, spec.openapis.org

Oversized source lightweight scan

studio/web/assets/index-CqR2ie-M.js3.91 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsdiscord.comdiscord.ggdocs.harperdb.ioexample.comfabric.harper.fastfb.megithub.comjs.stripe.comstripe.comwww.google.comwww.harper.fastwww.w3.org

studio/web/assets/ts.worker-BDIg8HZU.js6.58 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

10 flagged · loading source

core/utility/terms/certificates.jsView file

8patternName = private_key_rsa severity = critical line = 8 matchedText = key: '--...ace(

Critical

Critical Secret

Package contains a critical-looking secret pattern.

core/utility/terms/certificates.jsView on unpkg · L8

8patternName = private_key_rsa severity = critical line = 8 matchedText = key: '--...ace(

Critical

Secret Pattern

RSA private key in core/utility/terms/certificates.js

core/utility/terms/certificates.jsView on unpkg · L8

core/upgrade/directives/5-1-0.tsView file

39const CreateTableObject = L40: require('../../dataLayer/CreateTableObject').default || require('../../dataLayer/CreateTableObject'); L41: const schema = (systemSchema as any)[DEPLOYMENT_TABLE];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/upgrade/directives/5-1-0.tsView on unpkg · L39

core/security/jsLoader.tsView file

13import * as env from '../[redacted]'; L14: import * as child_process from 'node:child_process'; L15: import { CONFIG_PARAMS } from '../utility/hdbTerms.ts'; ... L102: // the actual parse error (internally known as the "arrow message") L103: // is hidden behind a private symbol (arrowMessagePrivateSymbol) L104: // on the error object and the only way to access it is to use the ... L128: /** L129: * Parse a JSON string and return the resulting object. Wraps JSON.parse errors L130: * with the module URL for easier debugging. ... L340: const cjsWrapper = ` L341: (function(module, exports, require, __filename, __dirname) { L342: ${source}

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

core/security/jsLoader.tsView on unpkg · L13

core/agent/tools/httpFetchTool.tsView file

8L9: import { isIP } from 'node:net'; L10: import type { AgentTool, AgentToolContext } from '../types.ts'; ... L34: headers: { type: 'object', additionalProperties: { type: 'string' } }, L35: body: { type: 'string', description: 'Request body as a string (JSON or form-encoded).' }, L36: timeoutMs: { type: 'integer', minimum: 1, maximum: 120_000 }, ... L72: headers: Object.fromEntries(response.headers.entries()), L73: body: buffer.toString('utf8'), L74: truncated: buffer.length === MAX_BYTES,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

core/agent/tools/httpFetchTool.tsView on unpkg · L8

studio/web/assets/html.worker-CaVO4r1v.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

studio/web/assets/html.worker-CaVO4r1v.jsView on unpkg · L29

core/utility/scripts/user_data.shView file

•path = core/utility/scripts/user_data.sh kind = build_helper sizeBytes = 427 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/utility/scripts/user_data.shView on unpkg

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView file

•path = [redacted]-Bold-DDaUYG8E.woff kind = high_entropy_blob sizeBytes = 24936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView on unpkg

studio/web/assets/ts.worker-BDIg8HZU.jsView file

•path = studio/web/assets/ts.worker-BDIg8HZU.js kind = oversized_source_file sizeBytes = 6895331 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/web/assets/ts.worker-BDIg8HZU.jsView on unpkg

dist/core/utility/terms/certificates.jsView file

4patternName = private_key_rsa severity = critical line = 4 matchedText = key: '--...0)),

Critical

Secret Pattern

RSA private key in dist/core/utility/terms/certificates.js

dist/core/utility/terms/certificates.jsView on unpkg · L4

Source & flagged code

10 flagged

core/utility/terms/certificates.jsView file

Lines 1-28javascript

1'use strict';

2

3const CERTIFICATE_VALUES = {

4 cert: '-----BEGIN CERTIFICATE-----\rMIIDXDCCAkSgAwIBAgIFNTE4MzQwDQYJKoZIhvcNAQELBQAwXTEXMBUGA1UEAxMO\rSGFycGVyREIsIEluYy4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UE\rBxMGRGVudmVyMRcwFQYDVQQKEw5IYXJwZXJEQiwgSW5jLjAeFw0yMjAzMTEyMzAz\rNDlaFw0yNzAzMTAyMzAzNDlaMF0xFzAVBgNVBAMTDkhhcnBlckRCLCBJbmMuMQsw\rCQYDVQQGEwJVUzELMAkGA1UECBMCQ08xDzANBgNVBAcTBkRlbnZlcjEXMBUGA1UE\rChMOSGFycGVyREIsIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\rAQCsEUlBF8WImS78rCFXVKyntxfrW++4qZ3hGnoD2MHZAuDHyeP/5eGnaE9GQhKc\r4DwG4DGvh0wP2zIYnBfiQ3L2ZtnlDR9ZkKIQYGlVxTUn6T43krhK5nZKqDF43Yg3\rZEvO3cbJBjiKZx0eA2/toehdSsTAHHQx5gT ...

5 /\r/g,

6 String.fromCharCode(13, 10)

7 ),

8 key: '-----BEGIN RSA PRIVATE KEY-----\rMIIEowIBAAKCAQEArBFJQRfFiJku/KwhV1Ssp7cX61vvuKmd4Rp6A9jB2QLgx8nj\r/+Xhp2hPRkISnOA8BuAxr4dMD9syGJwX4kNy9mbZ5Q0fWZCiEGBpVcU1J+k+N5K4\rSuZ2SqgxeN2IN2RLzt3GyQY4imcdHgNv7aHoXUrEwBx0MeYEw3IIDXtrYKCR2D8I\rvWBfwMUgWa24G8lpWILWA5hd9srRz9NxlAiHSjhbgT7B0xruEpHRCHSyKjvaIJVt\rWBR+amejYsAKVrD/hgrqjsA1123Y6++YqvU6vwg64xhS2kz5r3dkNKhvwbWgpZdI\rIaRvsiB77f4kLGo0vi8RFgJ1ZRjGg3RRK2w1LQIDAQABAoIBAQCEOmh78EOpnGZC\rYBjjHrvrysVD5gvLcfVUtl8Ls7gMB60re1eOIF+PoZZCHKZnDd6zPfiQtj1adg0C\rYnnsM/8VoaZS4gm0b3RLd3ubIQifWhuo40RissY2yxfxlPSH9LhZCY8ojnJG0cTL\resK579E8WCfopjUY33XLqEbN7Ylv39J+ ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

core/utility/terms/certificates.jsView on unpkg · L8

Critical

Secret Pattern

9 /\r/g,

10 String.fromCharCode(13, 10)

11 ),

12};

13

14const CERTIFICATE_PEM_NAME = 'certificate.pem';

15const PRIVATEKEY_PEM_NAME = 'privateKey.pem';

16const CA_PEM_NAME = 'caCertificate.pem';

17

18const CERT_NAME = {

19 'DEFAULT': 'default',

20 'DEFAULT-CA': 'default-ca',

21 'SERVER': 'server',

22 'CA': 'ca',

23 'OPERATIONS-API': 'operations-api',

24 'OPERATIONS-CA': 'operations-ca',

25};

26

27const CERT_CONFIG_NAME_MAP = {

28 tls_certificate: CERT_NAME.SERVER,

Long lines were clipped for display.

core/upgrade/directives/5-1-0.tsView file

Lines 19-59typescript

19import * as terms from '../../utility/hdbTerms.ts';

20import * as initPaths from '../../dataLayer/harperBridge/lmdbBridge/lmdbUtility/initializePaths.js';

21import bridge from '../../dataLayer/harperBridge/harperBridge.ts'

core/security/jsLoader.tsView file

Lines 1-33typescript

1import { Resource } from '../resources/Resource.ts';

2import { contextStorage, transaction } from '../resources/transaction.ts';

3import { RequestTarget } from '../resources/RequestTarget.ts';

4import { tables, databases } from '../resources/databases.ts'

core/agent/tools/httpFetchTool.tsView file

Lines 1-28typescript

1/**

2 * `http_fetch` for the built-in agent (#626). Wraps the platform `fetch`

3 * with a size cap, an inactivity timeout, and a metadata/loopback blocklist

4 * so the agent can probe its own deployed components and pull lightweight

5 * web pages for context without becoming an SSRF vector against cloud

6 * instance-metadata endpoints or unrelated internal services.

7 */

8

9import { isIP } from 'node:net'

studio/web/assets/html.worker-CaVO4r1v.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

studio/web/assets/html.worker-CaVO4r1v.jsView on unpkg · L29

core/utility/scripts/user_data.shView file

•path = core/utility/scripts/user_data.sh kind = build_helper sizeBytes = 427 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/utility/scripts/user_data.shView on unpkg

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView file

•path = [redacted]-Bold-DDaUYG8E.woff kind = high_entropy_blob sizeBytes = 24936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView on unpkg

studio/web/assets/ts.worker-BDIg8HZU.jsView file

•path = studio/web/assets/ts.worker-BDIg8HZU.js kind = oversized_source_file sizeBytes = 6895331 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/web/assets/ts.worker-BDIg8HZU.jsView on unpkg

dist/core/utility/terms/certificates.jsView file

Lines 1-24javascript

1'use strict';

2const CERTIFICATE_VALUES = {

3 cert: '-----BEGIN CERTIFICATE-----\rMIIDXDCCAkSgAwIBAgIFNTE4MzQwDQYJKoZIhvcNAQELBQAwXTEXMBUGA1UEAxMO\rSGFycGVyREIsIEluYy4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UE\rBxMGRGVudmVyMRcwFQYDVQQKEw5IYXJwZXJEQiwgSW5jLjAeFw0yMjAzMTEyMzAz\rNDlaFw0yNzAzMTAyMzAzNDlaMF0xFzAVBgNVBAMTDkhhcnBlckRCLCBJbmMuMQsw\rCQYDVQQGEwJVUzELMAkGA1UECBMCQ08xDzANBgNVBAcTBkRlbnZlcjEXMBUGA1UE\rChMOSGFycGVyREIsIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB