registry / harnessed / 4.32.1

harnessed@4.32.1

AI coding harness package manager + composition orchestrator

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 548 KB of source, external domains: api.github.com, bun.sh, git-scm.com, github.com, harnessed.dev

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, realpathSync, mkdtempSync, utimesSync, rmSync, statSync } from 'fs';

3import { homedir, tmpdir } from 'os';

4import { join, resolve, dirname, basename, sep, isAbsolute, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, access, rename, appendFile, copyFile, chmod } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { LineCounter, parseDocument, parse, isSeq, isScalar, stringify } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, execSync, exec, execFile } from 'child_process';

13import { pathToFileURL, fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

Lines 3974-4014javascript

3974var defaultSpawnDriver, defaultPauseFn, defaultAssessComplexity, defaultPromptUserUnderstanding, defaultPrompter;

3975var init_masterOrchestrator_helpers = __esm({

3976 "src/workflow/masterOrchestrator-helpers.ts"() {

3977 init_before_spawn();

3978 init_run();

3979 defaultSpawnDriver = async (masterName, subName, _context, packageRoot)

Source & flagged code

3 flagged · loading source

dist/cli.mjsView file

11import * as ajvFormatsNs from 'ajv-formats'; L12: import { execFileSync, spawnSync, spawn, execSync, exec, execFile } from 'child_process'; L13: import { pathToFileURL, fileURLToPath } from 'url'; ... L21: import { Command } from 'commander'; L22: import { stdout, stdin } from 'process'; L23: import * as readline from 'readline/promises'; ... L34: L35: // package.json L36: var package_default; ... L47: type: "git", L48: url: "https://github.com/easyinplay/harnessed.git" L49: },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

3994if (!process.stdin.isTTY) return; L3995: const readline2 = await import('readline/promises'); L3996: const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.mjsView on unpkg · L3994

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

Findings

1 High4 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/cli.mjs

MediumDynamic Requiredist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, readdirSync, realpathSync, mkdtempSync, utimesSync, rmSync, statSync } from 'fs';

3import { homedir, tmpdir } from 'os';

4import { join, resolve, dirname, basename, sep, isAbsolute, win32, relative } from 'path';

5import { Type } from '@sinclair/typebox';

6import { readFile, readdir, unlink, writeFile, stat, rm, cp, mkdir, access, rename, appendFile, copyFile, chmod } from 'fs/promises';

7import { Value } from '@sinclair/typebox/value';

8import lockfile from 'proper-lockfile';

9import { LineCounter, parseDocument, parse, isSeq, isScalar, stringify } from 'yaml';

10import { Ajv } from 'ajv';

11import * as ajvFormatsNs from 'ajv-formats';

12import { execFileSync, spawnSync, spawn, execSync, exec, execFile } from 'child_process';

13import { pathToFileURL, fileURLToPath } from 'url';

14import { createHash } from 'crypto';

15import { Parser } from 'expr-eval';

16import { query } from '@anthropic-ai/claude-agent-sdk';

17import { promisify } from 'util';

18import * as p from '@clack/prompts';

19import { createPatch } from 'diff';

20import pc from 'picocolors';

21import { Command } from 'commander';

22import { stdout, stdin } from 'process';

23import * as readline from 'readline/promises';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L11

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L11

25var __defProp = Object.defineProperty;

26var __getOwnPropNames = Object.getOwnPropertyNames;

27var __esm = (fn, res) => function __init() {

28 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

29};

30var __export = (target, all) => {

31 for (var name in all)

Lines 3974-4014javascript

3974var defaultSpawnDriver, defaultPauseFn, defaultAssessComplexity, defaultPromptUserUnderstanding, defaultPrompter;

3975var init_masterOrchestrator_helpers = __esm({

3976 "src/workflow/masterOrchestrator-helpers.ts"() {

3977 init_before_spawn();

3978 init_run();

3979 defaultSpawnDriver = async (masterName, subName, _context, packageRoot)