registry / @osfactory/har / 0.14.0

@osfactory/har@0.14.0

LLM-powered CLI for reproducible agent development environments

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 6 file(s), 1.69 MB of source, external domains: api.anthropic.com, console.anthropic.com, docs.anthropic.com, github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org, yargs.js.org

Source & flagged code

7 flagged

dist/index.jsView file

27040// src/utils/shell.ts L27041: var import_child_process = require("child_process"); L27042: function run(command2, options = {}) {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L27040

29298try { L29299: const raw = (0, import_child_process6.execSync)("npx --yes pm2 jlist", { L29300: encoding: "utf8",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L29298

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11

147for (let i2 = 0; i2 < n2; ++i2) { L148: const c2 = S2.charCodeAt(i2); L149: if (c2 < 55296 || c2 > 57343) { ... L1524: } L1525: get hostname() { L1526: if (this._url.host === null) { ... L1768: }, L1769: create(constructorArgs, privateData) { L1770: let obj = Object.create(URL2.prototype); ... L1813: var Stream2 = _interopDefault(require("stream")); L1814: var http = _interopDefault(require("http")); L1815: var Url = _interopDefault(require("url"));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L147

9345sourceCode = this.opts.code.process(sourceCode, sch); L9346: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L9347: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L9345

dist/templates/stage-templates/rocketsim/flows/example-smoke.shView file

•path = dist/templates/stage-[redacted]-smoke.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/templates/stage-templates/rocketsim/flows/example-smoke.shView on unpkg

dist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.shView file

•path = dist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.sh kind = payload_in_excluded_dir sizeBytes = 6549 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.shView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code