registry / harnessed / 4.15.2

harnessed@4.15.2

AI coding harness package manager + composition orchestrator

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The risky primitives are package-aligned orchestration and installer features activated by explicit CLI commands, not install-time or import-time behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs harnessed CLI commands such as setup, install, run, or explicit hook installation.

Impact

Can modify local Claude/Codex configuration and install declared upstream tools when invoked, but no stealth persistence, harvesting, or exfiltration was confirmed.

Mechanism

User-invoked AI workflow orchestration and upstream tool installation

Rationale

Static inspection shows a declared AI harness/orchestrator with explicit CLI-driven writes and upstream installs, but no lifecycle execution, stealth exfiltration, credential harvesting, destructive behavior, or unconsented AI-agent control-surface mutation. Scanner findings map to documented functionality rather than a concrete malicious payload.

Evidence

package.jsondist/index.mjsdist/cli.mjsbin/harnessed-inject-state.mjsREADME.mdmanifests/tools/superpowers.yamlmanifests/optional/perturn-inject.yaml

Network endpoints6

github.com/easyinplay/harnessed.gitgithub.com/ChromeDevTools/chrome-devtools-mcp.gitgithub.com/exa-labs/exa-mcp-server.gitgithub.com/tavily-ai/tavily-mcp.gitgithub.com/garrytan/gstack.gitgithub.com/midwayjs/midway.git

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/cli.mjs contains user-invoked setup/install code that can write Claude/Codex skills, commands, settings, and install upstream tools.
dist/cli.mjs can spawn SDK subagents and install MCP/plugins when commands such as setup/install/run are explicitly invoked.
manifests/*.yaml reference external npm/GitHub/Claude/Codex plugin installation commands.

Evidence against

package.json has no preinstall/postinstall lifecycle scripts; install does not execute package code.
dist/index.mjs only exports VERSION; import-time surface is inert.
bin/harnessed-inject-state.mjs is a bin/hook helper that reads local harnessed workflow state and prints context; no network or subprocess.
dist/cli.mjs setup/install paths are CLI-triggered, show diffs/confirmations for higher-risk writes, and align with the package's documented AI workflow orchestrator purpose.
Base setup loads manifests/tools and manifests/skill-packs, not optional per-turn hook manifests; hooks require explicit manifest install.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 405 KB of source, external domains: git-scm.com, github.com, harnessed.dev

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, dirname, resolve, sep, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, rename, access, appendFile } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

•matchType = previous_version_dangerous_delta matchedPackage = harnessed@4.15.1 matchedIdentity = npm:aGFybmVzc2Vk:4.15.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.mjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.mjsView on unpkg

11import * as ajvFormatsNs from 'ajv-formats'; L12: import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process'; L13: import { fileURLToPath } from 'url'; ... L21: import { Command } from 'commander'; L22: import { stdout, stdin } from 'process'; L23: import * as readline from 'readline/promises'; ... L34: L35: // package.json L36: var package_default; ... L47: type: "git", L48: url: "https://github.com/easyinplay/harnessed.git" L49: },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

Findings

1 Critical2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

86%Pass

Verdict confidence

IntentBenign

False-positive riskMedium

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Authoreasyinplay

Maintainerseasyinplay

Version4.26.0

PublishedJul 2, 2026

LicenseApache-2.0

Dependencies12

Integrityverified

Package size584 KB

Files170

Keywordsclaude-codeai-harnesspackage-managercompositionskill-packmcporchestrator

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.mjstypes → ./dist/index.d.tsexports mapbin → harnessed, harnessed-inject-state

Runtimenode >=22.0.0

Artifact2.23 MB · 170 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: bench, build, build:schema, dev +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, dirname, resolve, sep, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, rename, access, appendFile } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.mjsView on unpkg