registry / @hasna/instructions / 0.4.0

@hasna/instructions@0.4.0

AI coding agent instruction & configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 677 KB of source, external domains: 127.0.0.1, github.com, opencode.ai, truststore.pki.rds.amazonaws.com

Source & flagged code

3 flagged

package.jsonView file

Lines 22-62json

22 "dashboard/dist",

23 "LICENSE",

24 "README.md"

25 ],

26 "scripts": {

27 "clean": "rm -rf dist",

28 "build": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts --outdir dist --target bun --external pg && tsc --emitDeclarationOnly --outDir dist",

29 "build:server": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts --outdir dist --target bun --external pg",

30 "build:dashboard": "cd dashboard && bun run build",

31 "migrate": "bun run src/server/index.ts migrate",

32 "generate:sdk": "bun run scripts/generate-sdk.ts",

33 "kit:check": "bunx @hasna/contracts vendor-kit --check",

34 "typecheck": "tsc --noEmit",

35 "test": "bun test",

36 "check:package-secrets": "bun run src/cli/index.tsx package-manager-scan --fail-on-findings --home .",

37 "dev:cli": "bun run src/cli/index.tsx",

38 "dev:mcp": "bun run src/mcp/index.ts",

39 "dev:serve": "bun run src/server/index.ts",

40 "seed": "bun run scripts/seed.ts",

41 "prepublishOnly": "bun run build",

42 "postinstall": "mkdir -p $HOME/.hasna/instructions $HOME/.hasna/instructions/backups 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "keywords": [

45 "instructions",

46 "configs",

47 "dotfiles",

48 "agent-config",

49 "claude",

50 "codex",

51 "gemini",

52 "mcp",

53 "ai",

54 "coding-agent",

55 "cli",

56 "dashboard"

57 ],

58 "publishConfig": {

59 "registry": "https://registry.npmjs.org",

60 "access": "public"

61 },

62 "repository": {

dist/mcp/index.jsView file

Lines 35-75javascript

35 };

36 ConfigApplyError = class ConfigApplyError extends Error {

37 constructor(message) {

38 super(message);

39 this.name = "ConfigApplyError";

40 }

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = mkdir -p $HOME/.hasna/instructions $HOME/.hasna/instructions/backups 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = mkdir -p $HOME/.hasna/instructions $HOME/.hasna/instructions/backups 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/mcp/index.jsView file

55function getDbPath() { L56: if (process.env["HASNA_CONFIGS_DB_PATH"]) { L57: return process.env["HASNA_CONFIGS_DB_PATH"]; ... L233: try { L234: const parsed = JSON.parse(row.outputs || "[]"); L235: outputs = Array.isArray(parsed) ? parsed : []; ... L484: function detectMachineContext(overrides = {}) { L485: const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir(); L486: const os = overrides.os ?? currentOsType(); ... L491: id: "current-machine", L492: hostname: overrides.hostname ?? currentHostname(), L493: os,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/mcp/index.jsView on unpkg · L55

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/mcp/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 22-62json

22 "dashboard/dist",

23 "LICENSE",

24 "README.md"

25 ],

26 "scripts": {

27 "clean": "rm -rf dist",

30 "build:dashboard": "cd dashboard && bun run build",

31 "migrate": "bun run src/server/index.ts migrate",

32 "generate:sdk": "bun run scripts/generate-sdk.ts",

33 "kit:check": "bunx @hasna/contracts vendor-kit --check",

34 "typecheck": "tsc --noEmit",

35 "test": "bun test",

36 "check:package-secrets": "bun run src/cli/index.tsx package-manager-scan --fail-on-findings --home .",

37 "dev:cli": "bun run src/cli/index.tsx",

38 "dev:mcp": "bun run src/mcp/index.ts",

39 "dev:serve": "bun run src/server/index.ts",

40 "seed": "bun run scripts/seed.ts",

41 "prepublishOnly": "bun run build",

42 "postinstall": "mkdir -p $HOME/.hasna/instructions $HOME/.hasna/instructions/backups 2>/dev/null || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 },

44 "keywords": [

45 "instructions",

46 "configs",

47 "dotfiles",

48 "agent-config",

49 "claude",

50 "codex",

51 "gemini",

52 "mcp",

53 "ai",

54 "coding-agent",

55 "cli",

56 "dashboard"

57 ],

58 "publishConfig": {

59 "registry": "https://registry.npmjs.org",

60 "access": "public"

61 },

62 "repository": {

dist/mcp/index.jsView file

Lines 35-75javascript

35 };

36 ConfigApplyError = class ConfigApplyError extends Error {

37 constructor(message) {

38 super(message);

39 this.name = "ConfigApplyError";

40 }