Loading npm security reports…

@harperfast/harper@5.0.32: Suspicious npm security report (Warn) | LPM Firewall

registry / @harperfast/harper / 5.0.32

@harperfast/harper@5.0.32

⚠ Under review

Harper is an open-source Node.js performance platform that unifies database, cache, application, and messaging layers into one in-memory process.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 19 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 724 file(s), 15.2 MB of source, external domains: api.example.com, bit.ly, bugzilla.mozilla.org, cdn.jsdelivr.net, chevrotain.io, code.google.com, d20xtzwzcl0ceb.cloudfront.net, d3uc069fcn7uxw.cloudfront.net, data.jsdelivr.com, datatracker.ietf.org, developer.mozilla.org, developers.google.com, discord.com, discord.gg, docs.datadoghq.com, docs.harperdb.io, drafts.csswg.org, en.wikipedia.org, example.com, fabric.harper.fast, fb.me, github.com, google.com, googlechrome.github.io, hacks.mozilla.org, harper.fast, harperdb.io, harperdbhelp.zendesk.com, help.yahoo.com, html.spec.whatwg.org, instagram.com, js.stripe.com, json-schema.org, langium.org, official-joke-api.appspot.com, prettier.io, r12a.github.io, raw.githubusercontent.com, react.dev, redux-toolkit.js.org, redux.js.org, sass-lang.com, schema.org, soundcloud.com, spdx.org, spec.openapis.org, stackoverflow.com, stripe.com, support.google.com, swagger.io

Source & flagged code

9 flagged · loading source

dist/utility/terms/certificates.jsView file

4patternName = private_key_rsa severity = critical line = 4 matchedText = key: '--...0)),

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/utility/terms/certificates.jsView on unpkg · L4

4patternName = private_key_rsa severity = critical line = 4 matchedText = key: '--...0)),

Critical

Secret Pattern

RSA private key in dist/utility/terms/certificates.js

dist/utility/terms/certificates.jsView on unpkg · L4

upgrade/directives/directivesController.jsView file

8*/ L9: const hdbUtils = require('../../utility/common_utils.js'); L10: const hdbTerms = require('../../utility/hdbTerms.ts');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

upgrade/directives/directivesController.jsView on unpkg · L8

dist/resources/graphql.jsView file

1"use strict"; L2: Object.defineProperty(exports, "__esModule", { value: true });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/resources/graphql.jsView on unpkg · L1

studio/web/assets/html.worker-CaVO4r1v.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

studio/web/assets/html.worker-CaVO4r1v.jsView on unpkg · L29

utility/scripts/user_data.shView file

•path = utility/scripts/user_data.sh kind = build_helper sizeBytes = 427 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utility/scripts/user_data.shView on unpkg

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView file

•path = [redacted]-Bold-DDaUYG8E.woff kind = high_entropy_blob sizeBytes = 24936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView on unpkg

studio/web/assets/index-CiaiFfw1.jsView file

•path = studio/web/assets/index-CiaiFfw1.js kind = oversized_source_file sizeBytes = 4080924 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/web/assets/index-CiaiFfw1.jsView on unpkg

utility/terms/certificates.jsView file

8patternName = private_key_rsa severity = critical line = 8 matchedText = key: '--...ace(

Critical

Secret Pattern

RSA private key in utility/terms/certificates.js

utility/terms/certificates.jsView on unpkg · L8

Source & flagged code

9 flagged

dist/utility/terms/certificates.jsView file

Lines 1-24javascript

1'use strict';

2const CERTIFICATE_VALUES = {

3 cert: '-----BEGIN CERTIFICATE-----\rMIIDXDCCAkSgAwIBAgIFNTE4MzQwDQYJKoZIhvcNAQELBQAwXTEXMBUGA1UEAxMO\rSGFycGVyREIsIEluYy4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UE\rBxMGRGVudmVyMRcwFQYDVQQKEw5IYXJwZXJEQiwgSW5jLjAeFw0yMjAzMTEyMzAz\rNDlaFw0yNzAzMTAyMzAzNDlaMF0xFzAVBgNVBAMTDkhhcnBlckRCLCBJbmMuMQsw\rCQYDVQQGEwJVUzELMAkGA1UECBMCQ08xDzANBgNVBAcTBkRlbnZlcjEXMBUGA1UE\rChMOSGFycGVyREIsIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\rAQCsEUlBF8WImS78rCFXVKyntxfrW++4qZ3hGnoD2MHZAuDHyeP/5eGnaE9GQhKc\r4DwG4DGvh0wP2zIYnBfiQ3L2ZtnlDR9ZkKIQYGlVxTUn6T43krhK5nZKqDF43Yg3\rZEvO3cbJBjiKZx0eA2/toehdSsTAHHQx ...

4 key: '-----BEGIN RSA PRIVATE KEY-----\rMIIEowIBAAKCAQEArBFJQRfFiJku/KwhV1Ssp7cX61vvuKmd4Rp6A9jB2QLgx8nj\r/+Xhp2hPRkISnOA8BuAxr4dMD9syGJwX4kNy9mbZ5Q0fWZCiEGBpVcU1J+k+N5K4\rSuZ2SqgxeN2IN2RLzt3GyQY4imcdHgNv7aHoXUrEwBx0MeYEw3IIDXtrYKCR2D8I\rvWBfwMUgWa24G8lpWILWA5hd9srRz9NxlAiHSjhbgT7B0xruEpHRCHSyKjvaIJVt\rWBR+amejYsAKVrD/hgrqjsA1123Y6++YqvU6vwg64xhS2kz5r3dkNKhvwbWgpZdI\rIaRvsiB77f4kLGo0vi8RFgJ1ZRjGg3RRK2w1LQIDAQABAoIBAQCEOmh78EOpnGZC\rYBjjHrvrysVD5gvLcfVUtl8Ls7gMB60re1eOIF+PoZZCHKZnDd6zPfiQtj1adg0C\rYnnsM/8VoaZS4gm0b3RLd3ubIQifWhuo40RissY2yxfxlPSH9LhZCY8ojnJG0cTL\resK579E8WCfopjUY33XLqEbN7Ylv3 ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/utility/terms/certificates.jsView on unpkg · L4

Critical

Secret Pattern

RSA private key in dist/utility/terms/certificates.js

5};

6const CERTIFICATE_PEM_NAME = 'certificate.pem';

7const PRIVATEKEY_PEM_NAME = 'privateKey.pem';

8const CA_PEM_NAME = 'caCertificate.pem';

9const CERT_NAME = {

10 'DEFAULT': 'default',

11 'DEFAULT-CA': 'default-ca',

12 'SERVER': 'server',

13 'CA': 'ca',

14 'OPERATIONS-API': 'operations-api',

15 'OPERATIONS-CA': 'operations-ca',

16};

17const CERT_CONFIG_NAME_MAP = {

18 tls_certificate: CERT_NAME.SERVER,

19 tlsCertificateAuthority: CERT_NAME.CA,

20 customFunctions_tls_certificate: CERT_NAME.SERVER,

21 customFunctionsTlsCertificateAuthority: CERT_NAME.CA,

22 operationsApi_tls_certificate: CERT_NAME['OPERATIONS-API'],

23 operationsApiTlsCertificateAuthority: CERT_NAME['OPERATIONS-CA'],

24};

Long lines were clipped for display.

upgrade/directives/directivesController.jsView file

Lines 1-28javascript

1'use strict';

2

3/**

4 * The directive controller serves as an interface between directive files and HDB. Since we don't maintain file

5 * structure in the installed version, we need to require all directive files in order to make them accessible.

6 *

7 * Any time a directive file is added to the project, it must be required in this manager.

8 */

9const hdbUtils =

dist/resources/graphql.jsView file

Lines 1-21javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/resources/graphql.jsView on unpkg · L1

3exports.loadGQLSchema = exports.startOnMainThread = void

studio/web/assets/html.worker-CaVO4r1v.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

studio/web/assets/html.worker-CaVO4r1v.jsView on unpkg · L29

utility/scripts/user_data.shView file

•path = utility/scripts/user_data.sh kind = build_helper sizeBytes = 427 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

utility/scripts/user_data.shView on unpkg

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView file

•path = [redacted]-Bold-DDaUYG8E.woff kind = high_entropy_blob sizeBytes = 24936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

studio/web/assets/PPRadioGrotesk-Bold-DDaUYG8E.woffView on unpkg

studio/web/assets/index-CiaiFfw1.jsView file

•path = studio/web/assets/index-CiaiFfw1.js kind = oversized_source_file sizeBytes = 4080924 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/web/assets/index-CiaiFfw1.jsView on unpkg

utility/terms/certificates.jsView file

Lines 1-28javascript

1'use strict';

2

3const CERTIFICATE_VALUES = {

4 cert: '-----BEGIN CERTIFICATE-----\rMIIDXDCCAkSgAwIBAgIFNTE4MzQwDQYJKoZIhvcNAQELBQAwXTEXMBUGA1UEAxMO\rSGFycGVyREIsIEluYy4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDTzEPMA0GA1UE\rBxMGRGVudmVyMRcwFQYDVQQKEw5IYXJwZXJEQiwgSW5jLjAeFw0yMjAzMTEyMzAz\rNDlaFw0yNzAzMTAyMzAzNDlaMF0xFzAVBgNVBAMTDkhhcnBlckRCLCBJbmMuMQsw\rCQYDVQQGEwJVUzELMAkGA1UECBMCQ08xDzANBgNVBAcTBkRlbnZlcjEXMBUGA1UE\r