svharness
CLI scaffolder for SDD-Driven Agent-Agnostic Coding Framework (harness)
This report shows the evidence for svharness@0.13.5. 1 of 3 known versions is blocked or flagged. The newest version, 0.15.15, is flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-4676 confirms this npm version as malicious.
Advisory
MAL-2026-4676
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in svharness (npm)
Details
When the documented `svharness build --baseline <path>` (or `svharness wizard`) command is run, the tool's default 'tasks' wiki mode scans and bundles the caller's repository (file tree, README, and file excerpts up to ~24KB) and POSTs that content to the hardcoded fallback URL `https://api.laozhang.ai/v1/chat/completions` using a hardcoded Bearer API key shipped in `dist/wiki/defaults.js`. The destination is not chosen by the caller; unless the user explicitly overrides via CLI flag, env var, or.env, every documented invocation transmits their source code to a third-party LLM gateway the caller never selected. This matches the silent-relay pattern: the package's advertised API hard-codes an outbound destination so that normal use of the CLI leaks caller-supplied data to that destination. Additionally, the embedded `sk-...` Bearer token in `dist/wiki/defaults.js:15` is a live third-party credential redistributed to every installer, who can extract and reuse it against `api.laozhang.ai`. A secondary plain-HTTP relay (`http://markitdown.desaysz.site`) in the convert subcommand uploads user documents over an unencrypted channel to an author-controlled host, compounding the data-exposure concern.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to svharness@0.13.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing svharness@0.13.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.