registry / @haus-tech/haus-workflow / 1.5.5

@haus-tech/haus-workflow@1.5.5

Haus AI workflow CLI for Claude Code.

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 397 KB of source, external domains: api.github.com, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

4 flagged

package.jsonView file

Lines 20-60json

20 "CHANGELOG.md"

21 ],

22 "scripts": {

23 "build": "rm -rf dist && esbuild src/cli.ts --bundle --packages=external --platform=node --format=esm --outdir=dist --external:@inquirer/checkbox",

24 "dev": "tsx src/cli.ts",

25 "test": "node scripts/test-fast.mjs",

26 "test:full": "node scripts/run-tests.mjs tests/**/*.test.js",

27 "test:coverage": "c8 yarn test:full",

28 "coverage:check": "c8 --check-coverage yarn test:full",

29 "lint": "eslint src --cache --cache-location .eslintcache",

30 "format:check": "prettier --check --cache --cache-location .prettiercache .",

31 "format": "prettier --write --cache --cache-location .prettiercache .",

32 "typecheck": "tsc --noEmit",

33 "pack:local": "yarn pack",

34 "release": "GITHUB_TOKEN=$(gh auth token) release-it",

35 "release:dry": "GITHUB_TOKEN=$(gh auth token) release-it --dry-run",

36 "prepack": "yarn build",

37 "verify": "node scripts/verify.mjs",

38 "verify:full": "node scripts/verify.mjs --coverage",

39 "check:contract-behavior": "node --import tsx scripts/contract-behavior-check.mjs",

40 "postinstall": "node ./scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "prepare": "lefthook install || true",

42 "security:audit": "yarn npm audit -A -R --severity high --environment production"

43 },

44 "dependencies": {

45 "@inquirer/checkbox": "5.2.1",

46 "commander": "13.1.0",

47 "diff": "8.0.4",

48 "execa": "9.6.1",

49 "fast-glob": "3.3.3",

50 "fs-extra": "11.4.0",

51 "semver": "7.8.5",

52 "yaml": "2.9.0"

53 },

54 "devDependencies": {

55 "@release-it/conventional-changelog": "11.0.1",

56 "@types/fs-extra": "11.0.4",

57 "@types/node": "22.20.1",

58 "@types/semver": "7.8.0",

59 "@typescript-eslint/eslint-plugin": "8.65.0",

60 "@typescript-eslint/parser": "8.65.0",

dist/cli.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.js: await fs.writeFile(tempPath, value, "utf8"); followSymbolicLinks: false, ignore: ["**/node_modules/**", "**/dist/**"] "**/node_modules/**", var CATALOG_REPO_URL = "https://raw.githubusercontent.com/WeAreHausTech/haus-workflow-catalog"; var CATALOG_GITHUB_API_URL = "https://api.github.com/repos/WeAreHausTech/haus-workflow-catalog"; await fs2.writeFile(dest, text, "utf8"); await fs2.writeFile(dest, text, "utf8");

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @haus-tech/haus-workflow@1.5.3 matchedIdentity = npm:[redacted]:1.5.3 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

@haus-tech/haus-workflow@1.5.5

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code