@johpaz/hive-sdk
Hive SDK — Crear agentes IA con todo incluido: agentes, tools, skills, MCP, TTS, canales, gateway y más.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Monorepo source publish, not injected. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Local storage encryption key handling, benign. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Audio payload decoding, benign. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Growth matches added SDK modules/bundled deps, not injected payload. | ai | |
| source-diff | encoded-string-file:dist/tools/index.js | AI (source-diff): Bundled font/compressed-asset data (pdf-lib standard fonts), not obfuscated payload. | ai | |
| source-diff | encoded-string-file:dist/agents/index.js | AI (source-diff): Bundled font/compressed-asset data (pdf-lib standard fonts), not obfuscated payload. | ai | |
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Bundled font/compressed-asset data (pdf-lib standard fonts), not obfuscated payload. | ai | |
| phantom-deps | phantom-dep:cron-parser | AI (phantom-deps): Likely used alongside croner for scheduling features. | ai | |
| phantom-deps | phantom-dep:@sapphire/snowflake | AI (phantom-deps): Discord-related utility, plausibly used in discord channel code. | ai | |
| semgrep | semgrep:shady-links-exfil-services | AI (semgrep): Official Telegram Bot API file URL, not an exfil endpoint. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Test asserting the tool rejects file:// URLs. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Plugin loader eval on local module code, not remote payload. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Passes env to spawned MCP subprocess, standard pattern. | ai | |
| phantom-deps | phantom-dep:groq-sdk | AI (phantom-deps): Likely used via dynamic/optional provider loading in large SDK. | ai | |
| phantom-deps | phantom-dep:async-mutex | AI (phantom-deps): Common utility dep, false positive on heuristic import scan. | ai | |
| dependencies | unvetted-dep:@johpaz/hivelearn | AI (dependencies): Same-author workspace package matching new hivelearn export/build target. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 0.1.3 | 26 / 3 | |
| 0.0.15 | 19 / 2 | |
| 0.0.14 | 0 / 0 | |
| 0.0.12 | 0 / 0 | |
| 0.0.11 | 0 / 0 | |
| 0.0.10 | 0 / 0 | |
| 0.0.9 | 5 / 2 | |
| 0.0.8 | 5 / 3 | |
| 0.0.7 | 6 / 2 | |
| 0.0.6 | 5 / 2 | |
| 0.0.5 | 5 / 2 | |
| 0.0.4 | 1 / 2 | |
| 0.0.3 | 1 / 2 | |
| 0.0.2 | 1 / 2 | |
| 0.0.1 | 1 / 2 |
v0.1.3
5 findingsURL pointing to known exfiltration/tunneling service Source: https://github.com/johpaz/hive-sdk/blob/e600653d2209d4b7783abadc1f3c48d8047ffe6e/packages/core/src/channels/telegram.ts#L177 175 | if (file.file_path) { 176 | image = { > 177 | url: `https://api.telegram.org/file/bot${this.config.botToken}/${file.file_path}`, 178 | mimeType: "image/jpeg", 179 | caption: caption || undefined,
URL pointing to known exfiltration/tunneling service Source: https://github.com/johpaz/hive-sdk/blob/e600653d2209d4b7783abadc1f3c48d8047ffe6e/packages/core/src/channels/telegram.ts#L200 198 | const filePath = file.file_path; 199 | if (filePath) { > 200 | audioUrl = `https://api.telegram.org/file/bot${this.config.botToken}/${filePath}`; 201 | } 202 | } catch (error) {
URL pointing to known exfiltration/tunneling service Source: https://github.com/johpaz/hive-sdk/blob/e600653d2209d4b7783abadc1f3c48d8047ffe6e/packages/core/src/channels/telegram.ts#L248 246 | if (file.file_path) { 247 | document_ = { > 248 | url: `https://api.telegram.org/file/bot${this.config.botToken}/${file.file_path}`, 249 | mimeType: message.document.mime_type || "application/octet-stream", 250 | fileName: docName,
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/johpaz/hive-sdk/blob/e600653d2209d4b7783abadc1f3c48d8047ffe6e/packages/core/src/tools/web/api-request.test.ts#L142 140 | 141 | it("rejects non-http URLs", async () => { > 142 | const result = await apiRequestTool.execute({ url: "file:///etc/passwd" }); 143 | 144 | expect(result).toMatchObject({
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.9
4 findingsModified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.8
4 findingsModified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.7
4 findingsModified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.6
4 findingsModified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Modified file contains 15 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (bun) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.