registry / @12errh/antigravity-proxy / 1.0.11

@12errh/antigravity-proxy@1.0.11

LLM proxy for Antigravity — translate Google Gemini API calls to any provider

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 139 file(s), 837 KB of source, external domains: api.anthropic.com, api.groq.com, api.openai.com, generativelanguage.googleapis.com, integrate.api.nvidia.com, opencode.ai, openrouter.ai

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-67javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { createRequire } from 'module';

4import { execSync, spawn } from 'child_process';

5import { platform } from 'os';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

7const require = createRequire(import.meta.url);

8const pkg = require('../package.json');

10// Commands that need admin privileges on Windows

11const ADMIN_COMMANDS = ['start', 'switch', 'remove', 'setup', 'certs', 'stop'];

13function isAdmin() {

14 if (platform() !== 'win32') return true;

15 try {

16 execSync('net session', { stdio: 'pipe', timeout: 5000 });

17 return true;

18 } catch {

19 return false;

20 }

21}

23function elevateAndRun() {

27 if (platform() !== 'win32' || !ADMIN_COMMANDS.includes(cmd)) return false;

28 // start --simple doesn't need admin (just launches desktop app)

29 if (cmd === 'start' && args.includes('--simple')) return false;

30 if (isAdmin()) return false;

32 console.log('');

33 console.log(' Requesting Administrator access...');

34 console.log('');

36 try {

37 // Simple, reliable elevation: write a .cmd file and run it with cmd /c start

38 const nodeExe = process.execPath;

39 const scriptPath = process.argv[1];

40 const cmdLine = `"${nodeExe}" "${scriptPath}" ${args.join(' ')}`;

42 const fs = require('fs');

43 const tmpFile = `${process.env.TEMP || ''}\\antigravity_elevate.cmd`;

44 fs.writeFileSync(tmpFile, `@echo off\n${cmdLine}\npause`, 'utf-8');

46 // Use Shell.Application via VBScript for reliable elevation

47 const vbsFile = `${process.env.TEMP || ''}\\antigravity_elevate.vbs`;

48 const vbs = `Set oShell = CreateObject("Shell.Application")\noShell.ShellExecute "cmd.exe", "/c ""${tmpFile}""", "", "runas", 1`;

49 fs.writeFileSync(vbsFile, vbs, 'ascii');

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L47

51 // Launch VBScript - this triggers UAC and runs elevated

52 const child = require('child_process').spawn('cscript', ['//nologo', vbsFile], {

53 stdio: 'ignore',

54 detached: true,

55 });

56 child.unref();

58 // Clean up VBScript file after a delay

59 setTimeout(() => {

60 try { fs.unlinkSync(vbsFile); } catch {}

61 }, 2000);

63 return true;

64 } catch {

65 console.log(' Failed. Please run this terminal as Administrator.');

66 console.log('');

67 return true;

dist/cli/utils/cert.jsView file

Lines 1-22javascript

1import fs from 'fs';

2import path from 'path';

3import { execSync } from 'child_process';

4import { platform } from 'os';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/utils/cert.jsView on unpkg · L2

dist/cli/commands/start.jsView file

Lines 114-154javascript

114 const major = parseInt(nodeVersion.slice(1), 10);

115 if (major < 20) {

116 fail(`Node.js 20+ required (found ${nodeVersion})`);

117 process.exit(1

Source & flagged code

4 flagged · loading source

bin/cli.jsView file

3import { createRequire } from 'module'; L4: import { execSync, spawn } from 'child_process'; L5: import { platform } from 'os';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

47const vbsFile = `${process.env.TEMP || ''}\\antigravity_elevate.vbs`; L48: const vbs = `Set oShell = CreateObject("Shell.Application")\noShell.ShellExecute "cmd.exe", "/c ""${tmpFile}""", "", "runas", 1`; L49: fs.writeFileSync(vbsFile, vbs, 'ascii');

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L47

dist/cli/utils/cert.jsView file

2import path from 'path'; L3: import { execSync } from 'child_process'; L4: import { platform } from 'os'; ... L38: const b64 = lines.join(''); L39: const derBytes = Buffer.from(b64, 'base64'); L40: const crypto = require('crypto');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/utils/cert.jsView on unpkg · L2

dist/cli/commands/start.jsView file

134depSpinner.text = 'Installing dependencies...'; L135: execSync('npm install --production', { cwd: PROXY_DIR, stdio: 'pipe', timeout: 120000 }); L136: succeedSpinner(depSpinner, 'Dependencies installed');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/start.jsView on unpkg · L134

Findings

3 High3 Medium7 Low

HighChild Processbin/cli.js

HighShellbin/cli.js

HighRuntime Package Installdist/cli/commands/start.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli/utils/cert.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

bin/cli.jsView file

Lines 1-67javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { createRequire } from 'module';

4import { execSync, spawn } from 'child_process';

5import { platform } from 'os';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

7const require = createRequire(import.meta.url);

8const pkg = require('../package.json');

10// Commands that need admin privileges on Windows

11const ADMIN_COMMANDS = ['start', 'switch', 'remove', 'setup', 'certs', 'stop'];

13function isAdmin() {

14 if (platform() !== 'win32') return true;

15 try {

16 execSync('net session', { stdio: 'pipe', timeout: 5000 });

17 return true;

18 } catch {

19 return false;

20 }

21}

23function elevateAndRun() {

27 if (platform() !== 'win32' || !ADMIN_COMMANDS.includes(cmd)) return false;

28 // start --simple doesn't need admin (just launches desktop app)

29 if (cmd === 'start' && args.includes('--simple')) return false;

30 if (isAdmin()) return false;

32 console.log('');

33 console.log(' Requesting Administrator access...');

34 console.log('');

36 try {

37 // Simple, reliable elevation: write a .cmd file and run it with cmd /c start

38 const nodeExe = process.execPath;

39 const scriptPath = process.argv[1];

40 const cmdLine = `"${nodeExe}" "${scriptPath}" ${args.join(' ')}`;

42 const fs = require('fs');

43 const tmpFile = `${process.env.TEMP || ''}\\antigravity_elevate.cmd`;

44 fs.writeFileSync(tmpFile, `@echo off\n${cmdLine}\npause`, 'utf-8');

46 // Use Shell.Application via VBScript for reliable elevation

47 const vbsFile = `${process.env.TEMP || ''}\\antigravity_elevate.vbs`;

48 const vbs = `Set oShell = CreateObject("Shell.Application")\noShell.ShellExecute "cmd.exe", "/c ""${tmpFile}""", "", "runas", 1`;

49 fs.writeFileSync(vbsFile, vbs, 'ascii');

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L47

51 // Launch VBScript - this triggers UAC and runs elevated

52 const child = require('child_process').spawn('cscript', ['//nologo', vbsFile], {

53 stdio: 'ignore',

54 detached: true,

55 });

56 child.unref();

58 // Clean up VBScript file after a delay

59 setTimeout(() => {

60 try { fs.unlinkSync(vbsFile); } catch {}

61 }, 2000);

63 return true;

64 } catch {

65 console.log(' Failed. Please run this terminal as Administrator.');

66 console.log('');

67 return true;

dist/cli/utils/cert.jsView file

Lines 1-22javascript

1import fs from 'fs';

2import path from 'path';

3import { execSync } from 'child_process';

4import { platform } from 'os';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/utils/cert.jsView on unpkg · L2

dist/cli/commands/start.jsView file

Lines 114-154javascript

114 const major = parseInt(nodeVersion.slice(1), 10);

115 if (major < 20) {

116 fail(`Node.js 20+ required (found ${nodeVersion})`);

117 process.exit(1