registry  /  @osfactory/har  /  0.9.0

@osfactory/har@0.9.0

LLM-powered CLI for reproducible agent development environments

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
Manifest
CopyleftLicense
scanned 6 file(s), 1.63 MB of source, external domains: api.anthropic.com, console.anthropic.com, docs.anthropic.com, github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org, yargs.js.org

Source & flagged code

7 flagged · loading source
dist/index.jsView file
26700// src/utils/shell.ts L26701: var import_child_process = require("child_process"); L26702: function run(command2, options = {}) {
High
Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L26700
28833try { L28834: const raw = (0, import_child_process6.execSync)("npx --yes pm2 jlist", { L28835: encoding: "utf8",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L28833
11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L11
147for (let i2 = 0; i2 < n2; ++i2) { L148: const c2 = S2.charCodeAt(i2); L149: if (c2 < 55296 || c2 > 57343) { ... L1524: } L1525: get hostname() { L1526: if (this._url.host === null) { ... L1768: }, L1769: create(constructorArgs, privateData) { L1770: let obj = Object.create(URL2.prototype); ... L1813: var Stream2 = _interopDefault(require("stream")); L1814: var http = _interopDefault(require("http")); L1815: var Url = _interopDefault(require("url"));
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L147
9345sourceCode = this.opts.code.process(sourceCode, sch); L9346: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L9347: const validate = makeValidate(this, this.scope.get());
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L9345
dist/templates/stage-templates/rocketsim/flows/example-smoke.shView file
•path = dist/templates/stage-[redacted]-smoke.sh kind = build_helper sizeBytes = 3031 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/templates/stage-templates/rocketsim/flows/example-smoke.shView on unpkg
dist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.shView file
•path = dist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.sh kind = payload_in_excluded_dir sizeBytes = 6549 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.shView on unpkg

Findings

3 High6 Medium7 Low
HighChild Processdist/index.js
HighRuntime Package Installdist/index.js
HighPayload In Excluded Dirdist/templates/stage-templates/rocketsim/.har/stages/rocketsim-flows.sh
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumShips Build Helperdist/templates/stage-templates/rocketsim/flows/example-smoke.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License