registry / @web4.0/workflows / 1.0.3

@web4.0/workflows@1.0.3

Web4.0 Workflows service for job scheduling, batch processing, loops, signals, and workflow execution.

AI Security Review

scanned 16h ago · by lpm-firewall-ai

This is a workflow scheduler capable of making recurring HTTP POST requests to user-configured destinations. No hidden endpoint or install-time attack behavior is present.

Static reason

No blocking static signals were detected.

Trigger

A host runs the scheduler or invokes a configured batch, loop, or signal.

Impact

Potential SSRF or use of configured credentials/headers against arbitrary destinations if the host does not constrain job configuration.

Mechanism

configured outbound HTTP POST job execution

Rationale

No malicious install, persistence, harvesting, or concealed exfiltration chain was found. The package nevertheless provides a real arbitrary-destination scheduled request capability, warranting a warning as dangerous dual-use.

Evidence

package.jsonindex.jshandlers/v1/batch.jshandlers/v1/loop.jshandlers/v1/signals.jslibs/processing.jslibs/scheduler.js

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Unknown with low false-positive risk.

Evidence for warning

`libs/processing.js` POSTs scheduled job URLs assembled from stored `job.url`/`job.path`.

@web4.0/workflows@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code