registry / @haus-tech/haus-workflow / 5.0.1

@haus-tech/haus-workflow@5.0.1

Haus AI workflow CLI for Claude Code.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 11 file(s), 795 KB of source, external domains: api.github.com, claude.com, github.com, raw.githubusercontent.com

Source & flagged code

3 flagged

package.jsonView file

Lines 25-65json

25 "build": "rm -rf dist && esbuild src/cli.ts --bundle --packages=external --platform=node --format=esm --outdir=dist --external:@inquirer/checkbox",

26 "dev": "tsx src/cli.ts",

27 "test": "node scripts/test-fast.mjs",

28 "test:quick": "node scripts/test-fast.mjs --quick",

29 "test:full": "node scripts/run-tests.mjs tests/**/*.test.js",

30 "test:coverage": "c8 yarn test:full",

31 "coverage:check": "c8 --check-coverage yarn test:full",

32 "lint": "eslint src --cache --cache-location .eslintcache",

33 "format:check": "prettier --check --cache --cache-location .prettiercache .",

34 "format": "prettier --write --cache --cache-location .prettiercache .",

35 "typecheck": "tsc --noEmit",

36 "pack:local": "yarn pack",

37 "release": "GITHUB_TOKEN=$(gh auth token) release-it",

38 "release:dry": "GITHUB_TOKEN=$(gh auth token) release-it --dry-run",

39 "prepack": "yarn build",

40 "verify": "node scripts/verify.mjs",

41 "verify:full": "node scripts/verify.mjs --coverage",

42 "check:contract-behavior": "node --import tsx scripts/contract-behavior-check.mjs",

43 "check:mutation-table": "node scripts/check-mutation-table.mjs",

44 "check:docs-site": "node scripts/check-docs-site.mjs",

45 "postinstall": "node ./scripts/postinstall.mjs || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "prepare": "lefthook install || true",

47 "security:audit": "yarn npm audit -A -R --severity high --environment production"

48 },

49 "dependencies": {

50 "@inquirer/checkbox": "5.2.1",

51 "commander": "13.1.0",

52 "diff": "8.0.4",

53 "execa": "9.6.1",

54 "fast-glob": "3.3.3",

55 "fs-extra": "11.4.0",

56 "semver": "7.8.5",

57 "tar": "7.5.22",

58 "yaml": "2.9.0"

59 },

60 "devDependencies": {

61 "@release-it/conventional-changelog": "11.0.1",

62 "@types/fs-extra": "11.0.4",

63 "@types/node": "22.20.1",

64 "@types/semver": "7.8.0",

65 "@typescript-eslint/eslint-plugin": "8.67.0",

library/global/skills/request/scripts/archive.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

library/global/skills/request/scripts/archive.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

@haus-tech/haus-workflow@5.0.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code