registry / @hypersocial/hyperportal / 0.1.1

@hypersocial/hyperportal@0.1.1

Open-source dataroom you build and manage with an AI coding agent — one private link per recipient, read tracking, staged disclosure, verified revocation. Next.js + Vercel; ships with a Claude agent skill.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 76.8 KB of source, external domains: api.resend.com, portal.example.com, us.i.posthog.com, us.posthog.com

Source & flagged code

3 flagged

template/scripts/portal.mjsView file

Lines 24-64javascript

24 * to the redeploy, in which a leaked link still works. If you ever need instant

25 * revocation, teams must move out of env vars into a per-request store

26 * (Edge Config / KV) and lib/access.ts must become async.

27 *

Source & flagged code

3 flagged · loading source

template/scripts/portal.mjsView file

44import { randomBytes } from "node:crypto"; L45: import { spawnSync } from "node:child_process"; L46: import { writeFileSync, readFileSync, mkdtempSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/portal.mjsView on unpkg · L44

280async function phQuery(sql) { L281: const key = process.env.POSTHOG_PERSONAL_API_KEY; L282: if (!key) return null; L283: const res = await fetch(`${PH_HOST}/api/projects/${PH_PROJECT}/query/`, { L284: method: "POST", ... L294: const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"; L295: spawnSync(cmd, [url], { stdio: "ignore" }); L296: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

template/scripts/portal.mjsView on unpkg · L280

template/lib/notify.tsView file

35export function notifyRoomOpened(team: Team, req: Request): Promise<unknown> { L36: const key = process.env.RESEND_API_KEY; L37: const to = process.env.NOTIFY_TO; ... L55: L56: const when = new Intl.DateTimeFormat("en-US", { L57: dateStyle: "medium", ... L71: ``, L72: `Dashboard: https://us.posthog.[redacted]`, L73: ].join("\n"); ... L80: }, L81: body: JSON.stringify({ L82: from: process.env.NOTIFY_FROM ?? FALLBACK_FROM,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

template/lib/notify.tsView on unpkg · L35

Findings

4 High3 Medium3 Low

HighChild Processtemplate/scripts/portal.mjs

HighShell

HighSame File Env Network Executiontemplate/scripts/portal.mjs

HighSandbox Evasion Gated Capabilitytemplate/lib/notify.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 260-300javascript

260/** A team's effective tier (mirrors lib/access.ts tierOf: invalid ⇒ 1). */

261function tierOf(t) {

262 return Number.isInteger(t.tier) && t.tier >= 1 ? t.tier : 1;

263}

264

265/** Parse a --tier value or a positional tier arg into an int ≥ 1, or die. */

266function parseTier(raw) {

267 const n = Number(raw);

268 if (!Number.isInteger(n) || n < 1) die(`tier must be an integer ≥ 1, got ${JSON.stringify(raw)}`);

269 return n;

270}

271

272/** The counterparty's event stream on PostHog (the /events tab, not the empty

273 * Profile notebook the bare group URL lands on). Defaults to a 24h window in the

274 * UI — widen the date dropdown there for sparse viewers. */

275function phGroupUrl(org) {

276 return `${PH_HOST}/project/${PH_PROJECT}/groups/${PH_GROUP_TYPE}/${encodeURIComponent(org)}/events`;

277}

278

279/** Run a HogQL query, or null if no personal API key is configured. */

280async function phQuery(sql) {

281 const key = process.env.POSTHOG_PERSONAL_API_KEY;

282 if (!key) return null;

283 const res = await fetch(`${PH_HOST}/api/projects/${PH_PROJECT}/query/`, {

284 method: "POST",

285 headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },

286 body: JSON.stringify({ query: { kind: "HogQLQuery", query: sql } }),

287 });

288 if (!res.ok) die(`PostHog query failed: ${res.status} ${(await res.text()).slice(0, 300)}`);

289 return (await res.json()).results ?? [];

290}

291

292/** Open a URL in the default browser. */

293function openInBrowser(url) {

294 const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

295 spawnSync(cmd, [url], { stdio: "ignore" });

296}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

template/scripts/portal.mjsView on unpkg · L280

297

298// ─── commands ────────────────────────────────────────────────────────────────

299

300function cmdLs(flags) {

template/lib/notify.tsView file

Lines 15-55typescript

15// first "Acme Corp opened the room" alert would fire from their spam filter.

16const NON_HUMAN =

19/** Vercel RFC3986-encodes geo headers; "New York" arrives as "New%20York". */

20function geo(req: Request, header: string): string | null {

21 const raw = req.headers.get(header);

22 if (!raw) return null;

23 try {

24 return decodeURIComponent(raw);

25 } catch {

26 return raw; // malformed encoding: better a literal value than nothing

27 }

28}

30/**

31 * Returns the in-flight send so the caller can hand it to waitUntil(). Orphaning

32 * this promise loses the email: Vercel may freeze the invocation the moment the

33 * response is returned, before the request to Resend leaves the machine.

34 */

35export function notifyRoomOpened(team: Team, req: Request): Promise<unknown> {

36 const key = process.env.RESEND_API_KEY;

37 const to = process.env.NOTIFY_TO;

38 if (!key || !to) return Promise.resolve();

40 // Our own previews are not news.

41 if (/internal/i.test(team.org)) return Promise.resolve();

43 const ua = req.headers.get("user-agent") ?? "";

44 if (!ua || NON_HUMAN.test(ua)) return Promise.resolve();

46 // Browsers speculatively fetch links. A prefetch is not a visit.

47 const purpose =

48 req.headers.get("sec-purpose") ?? req.headers.get("purpose") ?? "";

49 if (/prefetch|prerender/i.test(purpose)) return Promise.resolve();

51 const city = geo(req, "x-vercel-ip-city");

52 const region = geo(req, "x-vercel-ip-country-region");

53 const country = geo(req, "x-vercel-ip-country");

54 const where = [city, region, country].filter(Boolean).join(", ") || "unknown location";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

template/lib/notify.tsView on unpkg · L35