registry / Data exfiltration / haraps
haraps
NPM package to scaffold standard development environment, deployment scripts, AGENTS.md guidelines, and core workflows for a Next.js frontend + Rust Cloudflare Worker backend.
This report shows the evidence for haraps@1.0.6. 1 of 4 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiAlthough no lifecycle hook runs at install, the source contains a concrete externally directed reporting channel that transmits host and deployment data after the package’s generated script is used. The hard-coded recipient and unrelated project-specific telemetry exceed normal generic scaffolding behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Run `npx haraps`, then execute the generated `deploy.ps1`.
Impact
Leaks deployment metadata, public IP, and potentially error-derived sensitive details to a third-party service; installs packages and mutates agent control files.
Mechanism
project scaffolding plus deployment-report exfiltration
Attack narrative
The package is an explicit scaffolder, but it silently installs additional dependencies and plants broad agent instructions in the target repository. Its generated PowerShell deployment script reads local environment files, fetches the machine’s public IP, builds a report that can contain failure details, and POSTs it with a hard-coded chat identifier to an external Mediqueue endpoint. This is a concrete, package-supplied data-exfiltration path activated by the generated deployment workflow.
AI rationale
Although no lifecycle hook runs at install, the source contains a concrete externally directed reporting channel that transmits host and deployment data after the package’s generated script is used. The hard-coded recipient and unrelated project-specific telemetry exceed normal generic scaffolding behavior.
Evidence
package.jsonbin/index.jsdeploy.ps1README.mdSKILL.mdAGENTS.md.agents/workflows/git-it.md.agents/workflows/deploy-and-talk.md.agents/skills/ponytail/SKILL.md.agents/skills/ui-sniper-telegram/SKILL.md.agents/skills/kill-ai-slop/SKILL.md.agents/skills/security-review/SKILL.md.env.env.localfrontend/.env.local
Network endpoints3
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- bin/index.js writes AGENTS.md and multiple .agents workflows/skills into the current project.
- bin/index.js automatically runs `npm install ui-sniper html2canvas` when the target has package.json.
- Generated deploy.ps1 reads .env/.env.local files into its process environment.
- Generated deploy.ps1 obtains the host public IP from api.ipify.org.
- Generated deploy.ps1 posts a deployment report and hard-coded chat ID to api.mediqueue.hara-xy.com.
- The deployment report can include command details and critical error text.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Network behavior is in a generated deployment script, not automatic package installation.
- No credential-file harvesting, obfuscated payload, eval, or remote code-loading was found.
- The CLI’s primary behavior is explicit project scaffolding.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
4 flagged · loading sourcebin/index.jsView file
4const path = require('path');
L5: const { execSync } = require('child_process');
L6:
High
254stdio: ['ignore', 'pipe', 'pipe'],
L255: shell: true
L256: });
High
251function startWorker() {
L252: workerChild = spawn('npx', ['concurrently', '-c', 'cyan', '-n', 'worker', '"npm run dev --prefix worker"'], {
L253: env: { ...process.env, FORCE_COLOR: '1' },
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/index.jsView on unpkg · L251dev.shView file
•
Findings
3 High3 Medium4 Low
HighChild Processbin/index.js
HighShellbin/index.js
HighRuntime Package Installbin/index.js
MediumEnvironment Vars
MediumShips Build Helperdev.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to haraps@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing haraps@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.