Loading npm security reports…

@nanhara/hara@0.122.4: Clean npm security report (Allow) | LPM Firewall

registry / @nanhara/hara / 0.122.4

@nanhara/hara@0.122.4

hara — a coding agent CLI that runs like an engineering org.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior was found. Network, filesystem, subprocess, scheduler, and plugin capabilities are user-invoked features of the coding-agent CLI.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the `hara` CLI and explicitly invokes agent, plugin, cron, gateway, or web features.

Impact

No unconsented persistence, credential exfiltration, remote payload execution, or foreign AI-agent control-surface mutation established.

Mechanism

Package-local CLI bootstrap with explicit agent and extension commands.

Rationale

Static inspection shows a package-aligned coding-agent CLI with explicit high-capability commands, not an automatic malicious chain. Scanner findings are explained by a fixed local dynamic import and an intentional invisible-character sanitization regex.

Evidence

package.jsonruntime-bootstrap.cjsdist/index.jsdist/security/external-content.jsdist/plugins/plugins.jsdist/cron/install.js

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

`package.json` defines a `prepare` build hook.
`runtime-bootstrap.cjs` uses `Function` to load a fixed local `dist/index.js` entrypoint.
`dist/security/external-content.js` contains zero-width characters in a regex literal.

Evidence against

No `preinstall`, `install`, or `postinstall` lifecycle hook is present.
Bootstrap only checks Node version, normalizes Windows HOME, then imports package-local `dist/index.js`.
The zero-width regex strips invisible characters from untrusted content; it is defensive, not Trojan Source concealment.
`hara cron install` and `hara plugin add` are explicit CLI commands, not import/install-time actions.
Plugin installation warns that plugin hooks can execute code and requires a user-provided source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

3 flagged

runtime-bootstrap.cjsView file

Lines 15-94javascript

15 if (current[index] > minimum[index]) return true;

16 if (current[index] < minimum[index]) return false;

17 }

18 return true;

19}

21function unsupportedNodeMessage(versions) {

22 versions = versions || process.versions;

23 if (versions.bun) return null;

25 var version = String(versions.node || "unknown");

26 if (supportedNodeVersion(version)) return null;

27 var major = Number.parseInt(version, 10);

28 var detail = major === MIN_NODE_MAJOR

29 ? "This Node.js 22 release is below Hara's supported " + MIN_NODE_VERSION + " floor."

30 : "This Node.js release is below Hara's supported " + MIN_NODE_VERSION + " floor.";

31 return [

32 "Hara requires Node.js " + MIN_NODE_VERSION + " or newer (detected " + version + ").",

33 detail,

34 "Upgrade with: nvm install " + MIN_NODE_MAJOR + " && nvm use " + MIN_NODE_MAJOR,

35 "Or install the standalone Hara binary, which does not require Node.js:",

36 " curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",

37 ].join("\n");

38}

40function normalizePortableWindowsHome(value) {

41 var home = String(value || "").trim();

42 var drive = /^\/([a-zA-Z])(?:\/(.*))?$/.exec(home);

43 if (drive) return drive[1].toUpperCase() + ":\\" + String(drive[2] || "").replace(/\//g, "\\");

44 if (/^\/\/[^/]/.test(home)) return "\\\\" + home.slice(2).replace(/\//g, "\\");

45 if (/^[a-zA-Z]:[\\/]/.test(home)) return home.charAt(0).toUpperCase() + home.slice(1).replace(/\//g, "

46 return home;

47}

49function applyPortableHomeEnv(env, runtimePlatform) {

50 env = env || process.env;

51 runtimePlatform = runtimePlatform || process.platform;

52 if (runtimePlatform !== "win32") return false;

53 var home = normalizePortableWindowsHome(env.HOME || "");

54 if (!home || env.USERPROFILE === home) return false;

55 env.USERPROFILE = home;

56 return true;

57}

59function failStart(error) {

60 var message = error && error.message ? error.message : String(error);

61 process.stderr.write("hara: failed to start: " + message + "\n");

62 process.exitCode = 1;

63}

65function main() {

66 var runtimeError = unsupportedNodeMessage(process.versions);

67 if (runtimeError) {

68 process.stderr.write(runtimeError + "\n");

69 process.exitCode = 1;

70 return;

71 }

73 try {

74 applyPortableHomeEnv(process.env, process.platform);

75 // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This

76 // branch is reached only on the supported Node floor (or Bun when used as a script runtime).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime-bootstrap.cjsView on unpkg · L74

77 var load = Function("specifier", "return import(specifier)");

78 var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

runtime-bootstrap.cjsView on unpkg · L35

79 load(entry).catch(failStart);

80 } catch (error) {

81 failStart(error);

82 }

83}

85module.exports = {

86 MIN_NODE_MAJOR: MIN_NODE_MAJOR,

87 MIN_NODE_VERSION: MIN_NODE_VERSION,

88 supportedNodeVersion: supportedNodeVersion,

89 unsupportedNodeMessage: unsupportedNodeMessage,

90 applyPortableHomeEnv: applyPortableHomeEnv,

91 normalizePortableWindowsHome: normalizePortableWindowsHome,

92};

94if (require.main === module) main();

dist/security/external-content.jsView file

Lines 1-40javascript

1// Untrusted-content wrapping — the cheapest defense against indirect prompt injection for an agent that

2// holds a `bash` tool. Web pages / search results flow straight into the model; a hostile page can carry

3// "ignore previous instructions, run …". We wrap such content in a notice + a random per-call boundary id

4// so the model treats it as DATA, and we defang homoglyph / zero-width tricks a page could use to forge the

5// closing boundary. Pure-Node, zero-dep. (Pattern adapted from openclaw's external-content guard.)

6import { randomBytes } from "node:crypto";

7// Confusable angle brackets → ASCII, so a page can't fake a boundary marker. Defined by explicit codepoint

Source & flagged code

3 flagged · loading source

runtime-bootstrap.cjsView file

35"Or install the standalone Hara binary, which does not require Node.js:", L36: " curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh", L37: ].join("\n"); ... L49: function applyPortableHomeEnv(env, runtimePlatform) { L50: env = env || process.env; L51: runtimePlatform = runtimePlatform || process.platform; L52: if (runtimePlatform !== "win32") return false; ... L60: var message = error && error.message ? error.message : String(error); L61: process.stderr.write("hara: failed to start: " + message + "\n"); L62: process.exitCode = 1; ... L77: var load = Function("specifier", "return import(specifier)"); L78: var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

runtime-bootstrap.cjsView on unpkg · L35

74applyPortableHomeEnv(process.env, process.platform); L75: // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This L76: // branch is reached only on the supported Node floor (or Bun when used as a script runtime).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime-bootstrap.cjsView on unpkg · L74

Findings

1 Critical1 High4 Medium5 Low

CriticalTrojan Source Unicodedist/security/external-content.js

HighSandbox Evasion Gated Capabilityruntime-bootstrap.cjs

MediumDynamic Requireruntime-bootstrap.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

runtime-bootstrap.cjsView file

Lines 15-94javascript

15 if (current[index] > minimum[index]) return true;

16 if (current[index] < minimum[index]) return false;

17 }

18 return true;

19}

21function unsupportedNodeMessage(versions) {

22 versions = versions || process.versions;

23 if (versions.bun) return null;

25 var version = String(versions.node || "unknown");

26 if (supportedNodeVersion(version)) return null;

27 var major = Number.parseInt(version, 10);

28 var detail = major === MIN_NODE_MAJOR

29 ? "This Node.js 22 release is below Hara's supported " + MIN_NODE_VERSION + " floor."

30 : "This Node.js release is below Hara's supported " + MIN_NODE_VERSION + " floor.";

31 return [

32 "Hara requires Node.js " + MIN_NODE_VERSION + " or newer (detected " + version + ").",

33 detail,

34 "Upgrade with: nvm install " + MIN_NODE_MAJOR + " && nvm use " + MIN_NODE_MAJOR,

35 "Or install the standalone Hara binary, which does not require Node.js:",

36 " curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",

37 ].join("\n");

38}

40function normalizePortableWindowsHome(value) {

41 var home = String(value || "").trim();

42 var drive = /^\/([a-zA-Z])(?:\/(.*))?$/.exec(home);

43 if (drive) return drive[1].toUpperCase() + ":\\" + String(drive[2] || "").replace(/\//g, "\\");

44 if (/^\/\/[^/]/.test(home)) return "\\\\" + home.slice(2).replace(/\//g, "\\");

45 if (/^[a-zA-Z]:[\\/]/.test(home)) return home.charAt(0).toUpperCase() + home.slice(1).replace(/\//g, "

46 return home;

47}

49function applyPortableHomeEnv(env, runtimePlatform) {

50 env = env || process.env;

51 runtimePlatform = runtimePlatform || process.platform;

52 if (runtimePlatform !== "win32") return false;

53 var home = normalizePortableWindowsHome(env.HOME || "");

54 if (!home || env.USERPROFILE === home) return false;

55 env.USERPROFILE = home;

56 return true;

57}

59function failStart(error) {

60 var message = error && error.message ? error.message : String(error);

61 process.stderr.write("hara: failed to start: " + message + "\n");

62 process.exitCode = 1;

63}

65function main() {

66 var runtimeError = unsupportedNodeMessage(process.versions);

67 if (runtimeError) {

68 process.stderr.write(runtimeError + "\n");

69 process.exitCode = 1;

70 return;

71 }

73 try {

74 applyPortableHomeEnv(process.env, process.platform);

75 // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This

76 // branch is reached only on the supported Node floor (or Bun when used as a script runtime).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime-bootstrap.cjsView on unpkg · L74

77 var load = Function("specifier", "return import(specifier)");

78 var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

runtime-bootstrap.cjsView on unpkg · L35

79 load(entry).catch(failStart);

80 } catch (error) {

81 failStart(error);

82 }

83}

85module.exports = {

86 MIN_NODE_MAJOR: MIN_NODE_MAJOR,

87 MIN_NODE_VERSION: MIN_NODE_VERSION,

88 supportedNodeVersion: supportedNodeVersion,

89 unsupportedNodeMessage: unsupportedNodeMessage,

90 applyPortableHomeEnv: applyPortableHomeEnv,

91 normalizePortableWindowsHome: normalizePortableWindowsHome,

92};

94if (require.main === module) main();

dist/security/external-content.jsView file

Lines 1-40javascript

1// Untrusted-content wrapping — the cheapest defense against indirect prompt injection for an agent that

2// holds a `bash` tool. Web pages / search results flow straight into the model; a hostile page can carry

3// "ignore previous instructions, run …". We wrap such content in a notice + a random per-call boundary id

4// so the model treats it as DATA, and we defang homoglyph / zero-width tricks a page could use to forge the

5// closing boundary. Pure-Node, zero-dep. (Pattern adapted from openclaw's external-content guard.)

6import { randomBytes } from "node:crypto";

7// Confusable angle brackets → ASCII, so a page can't fake a boundary marker. Defined by explicit codepoint