npm JavaScript analyzed 0.8.0

@hasna/conversations

v0.8.0

npm

Real-time CLI messaging for AI agents

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.8.0 · analyzer v33 · 1w ago

dynamic code execution new Function() package/bin/mcp.js :2894 const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);

code evidence v0.8.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 291

fs package/bin/hook.js :8 import { closeSync, fstatSync, openSync, readFileSync } from "fs";
fs package/bin/index.js :1991 import { copyFileSync, existsSync as existsSync3, mkdirSync, readdirSync, statSync } from "fs";
fs package/bin/local-read-worker.js :7 import { copyFileSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
fs package/bin/mcp.js :6938 import { closeSync, fstatSync, openSync, readFileSync } from "fs";
fs package/bin/serve.js :3478 var st = fs.createReadStream(file);
fs package/dist/index.js :21 import { closeSync, fstatSync, openSync, readFileSync } from "fs";
fs package/dist/sdk/index.js :21 import { closeSync, fstatSync, openSync, readFileSync } from "fs";
fs package/postinstall.js :9 import { existsSync, mkdirSync } from "node:fs";

shell package/bin/hook.js :7 import { spawnSync } from "child_process";
shell package/bin/index.js :2069 exec(sql) {
shell package/bin/local-read-worker.js :151 exec(sql) {
shell package/bin/mcp.js :6937 import { spawnSync } from "child_process";
shell package/dist/index.js :20 import { spawnSync } from "child_process";
shell package/dist/sdk/index.js :20 import { spawnSync } from "child_process";

secrets package/bin/serve.js :11803 const secret = process.env.HASNA_CONVERSATIONS_API_SIGNING_KEY?.trim() || process.env.HASNA_API_SIGNING_KEY?.trim() || process.env.API_KEY_SIGNING_SECRET?.trim();

show 5 more