registry / @hypersocial/hyperportal / 0.1.1

@hypersocial/hyperportal@0.1.1

Open-source dataroom you build and manage with an AI coding agent — one private link per recipient, read tracking, staged disclosure, verified revocation. Next.js + Vercel; ships with a Claude agent skill.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 76.8 KB of source, external domains: api.resend.com, portal.example.com, us.i.posthog.com, us.posthog.com

Source & flagged code

3 flagged

template/scripts/portal.mjsView file

Lines 24-64javascript

24 * to the redeploy, in which a leaked link still works. If you ever need instant

25 * revocation, teams must move out of env vars into a per-request store

26 * (Edge Config / KV) and lib/access.ts must become async.

27 *

28 * `expires` is unaffected by all this: expired() is evaluated at request time

29 * against a value already baked into the running deployment.

30 *

31 * WHY WE ASK THE SITE, NOT VERCEL

32 *

33 * `vercel redeploy <url>` rebuilds THAT deployment's source snapshot. If the

34 * latest production deployment is behind origin/main — a push still building, a

35 * failed build — then redeploying to apply an env change also rolls the room's

36 * CONTENT back, silently. So every redeploy asserts the live commit matches

37 * origin/main first.

38 *

39 * Vercel cannot answer "what commit is serving?" (`vercel inspect` reports no

40 * sha, and Ready != aliased). So the app exposes it at /api/version, behind a

41 * team cookie, and we ask the running site.

42 */

44import { randomBytes } from "node:crypto";

45import { spawnSync } from "node:child_process";

46import { writeFileSync, readFileSync, mkdtempSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/portal.mjsView on unpkg · L44

47import { tmpdir } from "node:os";

48import { join } from "node:path";

50// Load .env.local (gitignored) so a secret like POSTHOG_PERSONAL_API_KEY can live

51// there instead of the shell. Anything already in the real env always wins.

52try {

53 for (const line of readFileSync(join(process.cwd(), ".env.local"), "utf8").split("\n")) {

54 const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);

55 if (!m || process.env[m[1]] !== undefined) continue;

56 let v = m[2];

57 if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);

58 process.env[m[1]] = v;

59 }

60} catch { /* no .env.local — fine */ }

62const VAR = "PORTAL_TEAMS";

63const ENVIRONMENT = "production";

64// Production URL of this portal, e.g. https://portal.example.com. Set it in

Lines 260-300javascript

260/** A team's effective tier (mirrors lib/access.ts tierOf: invalid ⇒ 1). */

261function tierOf(t) {

262 return Number.isInteger(t.tier) && t.tier >= 1 ? t.tier : 1;

263}

264

265/** Parse a --tier value or a positional tier arg into an int ≥ 1, or die. */

266function parseTier(raw

template/lib/notify.tsView file

Lines 15-55typescript

15// first "Acme Corp opened the room" alert would fire from their spam filter.

16const NON_HUMAN =

Source & flagged code

3 flagged · loading source

template/scripts/portal.mjsView file

44import { randomBytes } from "node:crypto"; L45: import { spawnSync } from "node:child_process"; L46: import { writeFileSync, readFileSync, mkdtempSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/portal.mjsView on unpkg · L44

280async function phQuery(sql) { L281: const key = process.env.POSTHOG_PERSONAL_API_KEY; L282: if (!key) return null; L283: const res = await fetch(`${PH_HOST}/api/projects/${PH_PROJECT}/query/`, { L284: method: "POST", ... L294: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"; L295: spawnSync(cmd, [url], { stdio: "ignore" }); L296: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

template/scripts/portal.mjsView on unpkg · L280

template/lib/notify.tsView file

35export function notifyRoomOpened(team: Team, req: Request): Promise<unknown> { L36: const key = process.env.RESEND_API_KEY; L37: const to = process.env.NOTIFY_TO; ... L55: L56: const when = new Intl.DateTimeFormat("en-US", { L57: dateStyle: "medium", ... L71: ``, L72: `Dashboard: https://us.posthog.[redacted]`, L73: ].join("\n"); ... L80: }, L81: body: JSON.stringify({ L82: from: process.env.NOTIFY_FROM ?? FALLBACK_FROM,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

template/lib/notify.tsView on unpkg · L35

Findings

4 High3 Medium3 Low

HighChild Processtemplate/scripts/portal.mjs

HighShell

HighSame File Env Network Executiontemplate/scripts/portal.mjs

HighSandbox Evasion Gated Capabilitytemplate/lib/notify.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

template/scripts/portal.mjsView file

Lines 24-64javascript

24 * to the redeploy, in which a leaked link still works. If you ever need instant

25 * revocation, teams must move out of env vars into a per-request store

26 * (Edge Config / KV) and lib/access.ts must become async.

27 *

28 * `expires` is unaffected by all this: expired() is evaluated at request time

29 * against a value already baked into the running deployment.

30 *

31 * WHY WE ASK THE SITE, NOT VERCEL

32 *

33 * `vercel redeploy <url>` rebuilds THAT deployment's source snapshot. If the

34 * latest production deployment is behind origin/main — a push still building, a

35 * failed build — then redeploying to apply an env change also rolls the room's

36 * CONTENT back, silently. So every redeploy asserts the live commit matches

37 * origin/main first.

38 *

39 * Vercel cannot answer "what commit is serving?" (`vercel inspect` reports no

40 * sha, and Ready != aliased). So the app exposes it at /api/version, behind a

41 * team cookie, and we ask the running site.

42 */

44import { randomBytes } from "node:crypto";

45import { spawnSync } from "node:child_process";

46import { writeFileSync, readFileSync, mkdtempSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/portal.mjsView on unpkg · L44

47import { tmpdir } from "node:os";

48import { join } from "node:path";

50// Load .env.local (gitignored) so a secret like POSTHOG_PERSONAL_API_KEY can live

51// there instead of the shell. Anything already in the real env always wins.

52try {

53 for (const line of readFileSync(join(process.cwd(), ".env.local"), "utf8").split("\n")) {

54 const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);

55 if (!m || process.env[m[1]] !== undefined) continue;

56 let v = m[2];

57 if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);

58 process.env[m[1]] = v;

59 }

60} catch { /* no .env.local — fine */ }

62const VAR = "PORTAL_TEAMS";

63const ENVIRONMENT = "production";

64// Production URL of this portal, e.g. https://portal.example.com. Set it in

Lines 260-300javascript

260/** A team's effective tier (mirrors lib/access.ts tierOf: invalid ⇒ 1). */

261function tierOf(t) {

262 return Number.isInteger(t.tier) && t.tier >= 1 ? t.tier : 1;

263}

264

265/** Parse a --tier value or a positional tier arg into an int ≥ 1, or die. */

266function parseTier(raw

template/lib/notify.tsView file

Lines 15-55typescript

15// first "Acme Corp opened the room" alert would fire from their spam filter.

16const NON_HUMAN =