registry / harnessed / 4.20.0

harnessed@4.20.0

AI coding harness package manager + composition orchestrator

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 431 KB of source, external domains: bun.sh, git-scm.com, github.com, harnessed.dev

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, resolve, dirname, sep, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, rename, access, appendFile } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

•matchType = previous_version_dangerous_delta matchedPackage = harnessed@4.19.0 matchedIdentity = npm:aGFybmVzc2Vk:4.19.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.mjsView file

11import * as ajvFormatsNs from 'ajv-formats'; L12: import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process'; L13: import { fileURLToPath } from 'url'; ... L21: import { Command } from 'commander'; L22: import { stdout, stdin } from 'process'; L23: import * as readline from 'readline/promises'; ... L34: L35: // package.json L36: var package_default; ... L47: type: "git", L48: url: "https://github.com/easyinplay/harnessed.git" L49: },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/cli.mjs

HighPrevious Version Dangerous Deltadist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, resolve, dirname, sep, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, rename, access, appendFile } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg