registry / harnessed / 4.27.0

harnessed@4.27.0

AI coding harness package manager + composition orchestrator

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 516 KB of source, external domains: api.github.com, bun.sh, git-scm.com, github.com, harnessed.dev

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, resolve, dirname, basename, sep, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, access, rename, appendFile, copyFile, chmod } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { pathToFileURL, fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

Lines 4012-4052javascript

4012var defaultSpawnDriver, defaultPauseFn, defaultAssessComplexity, defaultPromptUserUnderstanding, defaultPrompter;

4013var init_masterOrchestrator_helpers = __esm({

4014 "src/workflow/masterOrchestrator-helpers.ts"() {

4015 init_before_spawn();

4016 init_run();

4017 defaultSpawnDriver = async (masterName, subName, _context, packageRoot)

•matchType = previous_version_dangerous_delta matchedPackage = harnessed@4.26.0 matchedIdentity = npm:aGFybmVzc2Vk:4.26.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist/cli.mjsView file

11import * as ajvFormatsNs from 'ajv-formats'; L12: import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process'; L13: import { pathToFileURL, fileURLToPath } from 'url'; ... L21: import { Command } from 'commander'; L22: import { stdout, stdin } from 'process'; L23: import * as readline from 'readline/promises'; ... L34: L35: // package.json L36: var package_default; ... L47: type: "git", L48: url: "https://github.com/easyinplay/harnessed.git" L49: },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

4032if (!process.stdin.isTTY) return; L4033: const readline2 = await import('readline/promises'); L4034: const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L4032

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

Findings

2 High4 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/cli.mjs

HighPrevious Version Dangerous Deltadist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, statSync } from 'fs';

3import { homedir } from 'os';

4import { join, resolve, dirname, basename, sep, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, access, rename, appendFile, copyFile, chmod } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { parse, LineCounter, parseDocument, isSeq, isScalar } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, exec, execSync, execFile } from 'child_process';

13import { pathToFileURL, fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

Lines 4012-4052javascript

4012var defaultSpawnDriver, defaultPauseFn, defaultAssessComplexity, defaultPromptUserUnderstanding, defaultPrompter;

4013var init_masterOrchestrator_helpers = __esm({

4014 "src/workflow/masterOrchestrator-helpers.ts"() {

4015 init_before_spawn();

4016 init_run();

4017 defaultSpawnDriver = async (masterName, subName, _context, packageRoot)

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg