registry / harnessed / 4.15.1

harnessed@4.15.1

AI coding harness package manager + composition orchestrator

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an AI workflow/orchestration CLI that can modify Claude/Codex skills, commands, settings, MCP config, and harnessed state only through explicit user-invoked commands.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs harnessed CLI commands such as setup, install, update, uninstall, checkpoint, or the documented inject-state hook.

Impact

Expected installation/configuration of AI workflow assets; no credential harvesting, covert exfiltration, lifecycle execution, or persistence beyond declared user-selected harness integration was found.

Mechanism

User-invoked AI harness installer and workflow state manager

Rationale

Static inspection shows powerful but package-aligned AI harness setup/install functionality, gated by explicit CLI invocation rather than npm lifecycle or import-time execution. The scanner's dangerous delta maps to declared orchestration prompts and installer code, not covert malware behavior.

Evidence

package.jsondist/index.mjsdist/cli.mjsbin/harnessed-inject-state.mjsmanifests/tools/*.yamlmanifests/cc-hooks/dashboard-autospawn.yaml~/.claude/skills/*~/.agents/skills/*~/.claude/commands/*.md~/.codex/prompts/*.md~/.claude/settings.json~/.claude.json~/.codex/config.toml~/.claude/harnessed/*~/.codex/harnessed/*

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with medium false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; only user-run build/test scripts.
dist/index.mjs only exports VERSION; no import-time side effects.
dist/cli.mjs dangerous primitives are CLI actions: setup/install/update/uninstall/checkpoint commands invoked by user.
dist/cli.mjs setup writes harness files under Claude/Codex config dirs and uses confirmations/--dry-run for installs.
bin/harnessed-inject-state.mjs is a hook helper that only reads harnessed state and repo planning files, prints context, and has no network/subprocess writes.
Network/process use is package-aligned: npm version check, claude/codex/npm/git/npx commands for explicit setup/install/update flows.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 403 KB of source, external domains: git-scm.com, github.com, harnessed.dev

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, dirname, resolve, sep, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, rename, access, appendFile } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

•matchType = previous_version_dangerous_delta matchedPackage = harnessed@4.15.0 matchedIdentity = npm:aGFybmVzc2Vk:4.15.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.mjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.mjsView on unpkg

11import * as ajvFormatsNs from 'ajv-formats'; L12: import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process'; L13: import { fileURLToPath } from 'url'; ... L21: import { Command } from 'commander'; L22: import { stdout, stdin } from 'process'; L23: import * as readline from 'readline/promises'; ... L34: L35: // package.json L36: var package_default; ... L47: type: "git", L48: url: "https://github.com/easyinplay/harnessed.git" L49: },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

Findings

1 Critical2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

89%Pass

Verdict confidence

IntentBenign

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Authoreasyinplay

Maintainerseasyinplay

Version4.26.0

PublishedJul 2, 2026

LicenseApache-2.0

Dependencies12

Integrityverified

Package size580 KB

Files170

Keywordsclaude-codeai-harnesspackage-managercompositionskill-packmcporchestrator

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.mjstypes → ./dist/index.d.tsexports mapbin → harnessed, harnessed-inject-state

Runtimenode >=22.0.0

Artifact2.22 MB · 170 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench, build, build:schema, dev +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, dirname, resolve, sep, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, rename, access, appendFile } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.mjsView on unpkg