Loading npm security reports…

@nanhara/hara@0.122.5: Clean npm security report (Allow) | LPM Firewall

registry / @nanhara/hara / 0.122.5

@nanhara/hara@0.122.5

hara — a coding agent CLI that runs like an engineering org.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface was established. Runtime network use and filesystem/process capabilities support the stated coding-agent CLI and require executing user commands.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Executing `hara`; scheduler and plugin changes require explicit `hara cron install` or `hara plugin add` commands.

Impact

No unconsented persistence, exfiltration, remote payload execution, or foreign AI-agent control-surface mutation was confirmed.

Mechanism

Local CLI bootstrap, user-invoked agent tooling, optional update check, and explicit scheduler/plugin management.

Rationale

Static inspection shows a coding-agent CLI with expected user-invoked execution, plugin, and scheduler features. The scanner's Trojan Source signal is a false positive from a defensive regex that removes invisible characters from untrusted content.

Evidence

package.jsonruntime-bootstrap.cjsdist/index.jsdist/update-check.jsdist/cron/install.jsdist/plugins/plugins.jsdist/security/external-content.js

Network endpoints2

registry.npmjs.org/@nanhara/hara/latestregistry.npmmirror.com/@nanhara/hara/latest

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

`runtime-bootstrap.cjs` uses `Function` only to defer a local dynamic import of `dist/index.js`.
`dist/cron/install.js` can create a launchd/crontab entry, but only through explicit `hara cron install` CLI wiring.
`dist/plugins/plugins.js` can clone and enable external plugins, but only through explicit `hara plugin add <source>`.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall`; `prepare` only invokes the package build.
`runtime-bootstrap.cjs` performs version checks, Windows HOME normalization, then imports packaged `dist/index.js`; no network or payload retrieval occurs.
`dist/security/external-content.js` contains zero-width characters only in a regex that strips them from untrusted content, not concealed executable logic.
`dist/update-check.js` makes an opt-out, daily background version check only to package registries and caches the result under `~/.hara`.
Scheduler and plugin mutations are package-owned and explicitly user-commanded; no foreign AI-agent control-surface writes were found.
No hidden binaries, native loaders, install-time exfiltration, credential harvesting, or destructive import-time behavior were found.

Source & flagged code

3 flagged

runtime-bootstrap.cjsView file

Lines 15-94javascript

15 if (current[index] > minimum[index]) return true;

16 if (current[index] < minimum[index]) return false;

17 }

18 return true;

19}

21function unsupportedNodeMessage(versions) {

22 versions = versions || process.versions;

23 if (versions.bun) return null;

25 var version = String(versions.node || "unknown");

26 if (supportedNodeVersion(version)) return null;

27 var major = Number.parseInt(version, 10);

28 var detail = major === MIN_NODE_MAJOR

29 ? "This Node.js 22 release is below Hara's supported " + MIN_NODE_VERSION + " floor."

30 : "This Node.js release is below Hara's supported " + MIN_NODE_VERSION + " floor.";

31 return [

32 "Hara requires Node.js " + MIN_NODE_VERSION + " or newer (detected " + version + ").",

33 detail,

34 "Upgrade with: nvm install " + MIN_NODE_MAJOR + " && nvm use " + MIN_NODE_MAJOR,

35 "Or install the standalone Hara binary, which does not require Node.js:",

36 " curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",

37 ].join("\n");

38}

40function normalizePortableWindowsHome(value) {

41 var home = String(value || "").trim();

42 var drive = /^\/([a-zA-Z])(?:\/(.*))?$/.exec(home);

43 if (drive) return drive[1].toUpperCase() + ":\\" + String(drive[2] || "").replace(/\//g, "\\");

44 if (/^\/\/[^/]/.test(home)) return "\\\\" + home.slice(2).replace(/\//g, "\\");

45 if (/^[a-zA-Z]:[\\/]/.test(home)) return home.charAt(0).toUpperCase() + home.slice(1).replace(/\//g, "

46 return home;

47}

49function applyPortableHomeEnv(env, runtimePlatform) {

50 env = env || process.env;

51 runtimePlatform = runtimePlatform || process.platform;

52 if (runtimePlatform !== "win32") return false;

53 var home = normalizePortableWindowsHome(env.HOME || "");

54 if (!home || env.USERPROFILE === home) return false;

55 env.USERPROFILE = home;

56 return true;

57}

59function failStart(error) {

60 var message = error && error.message ? error.message : String(error);

61 process.stderr.write("hara: failed to start: " + message + "\n");

62 process.exitCode = 1;

63}

65function main() {

66 var runtimeError = unsupportedNodeMessage(process.versions);

67 if (runtimeError) {

68 process.stderr.write(runtimeError + "\n");

69 process.exitCode = 1;

70 return;

71 }

73 try {

74 applyPortableHomeEnv(process.env, process.platform);

75 // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This

76 // branch is reached only on the supported Node floor (or Bun when used as a script runtime).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime-bootstrap.cjsView on unpkg · L74

77 var load = Function("specifier", "return import(specifier)");

78 var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

runtime-bootstrap.cjsView on unpkg · L35

79 load(entry).catch(failStart);

80 } catch (error) {

81 failStart(error);

82 }

83}

85module.exports = {

86 MIN_NODE_MAJOR: MIN_NODE_MAJOR,

87 MIN_NODE_VERSION: MIN_NODE_VERSION,

88 supportedNodeVersion: supportedNodeVersion,

89 unsupportedNodeMessage: unsupportedNodeMessage,

90 applyPortableHomeEnv: applyPortableHomeEnv,

91 normalizePortableWindowsHome: normalizePortableWindowsHome,

92};

94if (require.main === module) main();

dist/security/external-content.jsView file

Lines 1-40javascript

1// Untrusted-content wrapping — the cheapest defense against indirect prompt injection for an agent that

2// holds a `bash` tool. Web pages / search results flow straight into the model; a hostile page can carry

3// "ignore previous instructions, run …". We wrap such content in a notice + a random per-call boundary id

4// so the model treats it as DATA, and we defang homoglyph / zero-width tricks a page could use to forge the

5// closing boundary. Pure-Node, zero-dep. (Pattern adapted from openclaw's external-content guard.)

6import { randomBytes } from "node:crypto";

7// Confusable angle brackets → ASCII, so a page can't fake a boundary marker. Defined by explicit codepoint

Source & flagged code

3 flagged · loading source

runtime-bootstrap.cjsView file

35"Or install the standalone Hara binary, which does not require Node.js:", L36: " curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh", L37: ].join("\n"); ... L49: function applyPortableHomeEnv(env, runtimePlatform) { L50: env = env || process.env; L51: runtimePlatform = runtimePlatform || process.platform; L52: if (runtimePlatform !== "win32") return false; ... L60: var message = error && error.message ? error.message : String(error); L61: process.stderr.write("hara: failed to start: " + message + "\n"); L62: process.exitCode = 1; ... L77: var load = Function("specifier", "return import(specifier)"); L78: var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

runtime-bootstrap.cjsView on unpkg · L35

74applyPortableHomeEnv(process.env, process.platform); L75: // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This L76: // branch is reached only on the supported Node floor (or Bun when used as a script runtime).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime-bootstrap.cjsView on unpkg · L74

Findings

1 Critical1 High4 Medium5 Low

CriticalTrojan Source Unicodedist/security/external-content.js

HighSandbox Evasion Gated Capabilityruntime-bootstrap.cjs

MediumDynamic Requireruntime-bootstrap.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

runtime-bootstrap.cjsView file

Lines 15-94javascript

15 if (current[index] > minimum[index]) return true;

16 if (current[index] < minimum[index]) return false;

17 }

18 return true;

19}

21function unsupportedNodeMessage(versions) {

22 versions = versions || process.versions;

23 if (versions.bun) return null;

25 var version = String(versions.node || "unknown");

26 if (supportedNodeVersion(version)) return null;

27 var major = Number.parseInt(version, 10);

28 var detail = major === MIN_NODE_MAJOR

29 ? "This Node.js 22 release is below Hara's supported " + MIN_NODE_VERSION + " floor."

30 : "This Node.js release is below Hara's supported " + MIN_NODE_VERSION + " floor.";

31 return [

32 "Hara requires Node.js " + MIN_NODE_VERSION + " or newer (detected " + version + ").",

33 detail,

34 "Upgrade with: nvm install " + MIN_NODE_MAJOR + " && nvm use " + MIN_NODE_MAJOR,

35 "Or install the standalone Hara binary, which does not require Node.js:",

36 " curl -fsSL https://raw.githubusercontent.com/hara-cli/hara/main/install.sh | sh",

37 ].join("\n");

38}

40function normalizePortableWindowsHome(value) {

41 var home = String(value || "").trim();

42 var drive = /^\/([a-zA-Z])(?:\/(.*))?$/.exec(home);

43 if (drive) return drive[1].toUpperCase() + ":\\" + String(drive[2] || "").replace(/\//g, "\\");

44 if (/^\/\/[^/]/.test(home)) return "\\\\" + home.slice(2).replace(/\//g, "\\");

45 if (/^[a-zA-Z]:[\\/]/.test(home)) return home.charAt(0).toUpperCase() + home.slice(1).replace(/\//g, "

46 return home;

47}

49function applyPortableHomeEnv(env, runtimePlatform) {

50 env = env || process.env;

51 runtimePlatform = runtimePlatform || process.platform;

52 if (runtimePlatform !== "win32") return false;

53 var home = normalizePortableWindowsHome(env.HOME || "");

54 if (!home || env.USERPROFILE === home) return false;

55 env.USERPROFILE = home;

56 return true;

57}

59function failStart(error) {

60 var message = error && error.message ? error.message : String(error);

61 process.stderr.write("hara: failed to start: " + message + "\n");

62 process.exitCode = 1;

63}

65function main() {

66 var runtimeError = unsupportedNodeMessage(process.versions);

67 if (runtimeError) {

68 process.stderr.write(runtimeError + "\n");

69 process.exitCode = 1;

70 return;

71 }

73 try {

74 applyPortableHomeEnv(process.env, process.platform);

75 // Keeping import() inside a string prevents legacy parsers from seeing unsupported ESM syntax. This

76 // branch is reached only on the supported Node floor (or Bun when used as a script runtime).

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runtime-bootstrap.cjsView on unpkg · L74

77 var load = Function("specifier", "return import(specifier)");

78 var entry = require("url").pathToFileURL(require("path").join(__dirname, "dist", "index.js")).href;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

runtime-bootstrap.cjsView on unpkg · L35

79 load(entry).catch(failStart);

80 } catch (error) {

81 failStart(error);

82 }

83}

85module.exports = {

86 MIN_NODE_MAJOR: MIN_NODE_MAJOR,

87 MIN_NODE_VERSION: MIN_NODE_VERSION,

88 supportedNodeVersion: supportedNodeVersion,

89 unsupportedNodeMessage: unsupportedNodeMessage,

90 applyPortableHomeEnv: applyPortableHomeEnv,

91 normalizePortableWindowsHome: normalizePortableWindowsHome,

92};

94if (require.main === module) main();

dist/security/external-content.jsView file

Lines 1-40javascript

1// Untrusted-content wrapping — the cheapest defense against indirect prompt injection for an agent that

2// holds a `bash` tool. Web pages / search results flow straight into the model; a hostile page can carry

3// "ignore previous instructions, run …". We wrap such content in a notice + a random per-call boundary id

4// so the model treats it as DATA, and we defang homoglyph / zero-width tricks a page could use to forge the

5// closing boundary. Pure-Node, zero-dep. (Pattern adapted from openclaw's external-content guard.)

6import { randomBytes } from "node:crypto";

7// Confusable angle brackets → ASCII, so a page can't fake a boundary marker. Defined by explicit codepoint

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code