registry / @aegisrunner/runner / 1.2.0

@aegisrunner/runner@1.2.0

The AegisRunner self-hosted local executor — runs `aegis scan --local` scans AND `aegis run --local` test suites on your machine (browser stays local, brain + storage in the cloud). No Docker required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 278 KB of source, external domains: app.aegisrunner.com

Source & flagged code

5 flagged

bin.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2// @aegisrunner/scan-runner — Docker-free web executor for `aegis scan --local`.

3//

4// Thin launcher: ensure the browser is installed, map flags/env onto the

5// executor's env, then run the audited, brain-free executor bundle. Playwright is

6// a dependency of THIS package. No Docker.

7import { spawnSync } from 'node:child_process';

8import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin.mjsView on unpkg · L6

9import path from 'node:path';

11const require = createRequire(import.meta.url);

12const args = process.argv.slice(2);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin.mjsView on unpkg · L10

13const val = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };

14const has = (name) => args.includes(name);

16if (has('--help') || has('-h')) {

17 console.log(`aegis-scan-runner — Docker-free browser executor for \`aegis scan --local\`.

19Runs a local headless Chromium that claims scan jobs from AegisRunner over

20OUTBOUND HTTPS and drives them against your app. Your app, its traffic, and

21credentials never leave your machine; only the findings come back.

23Usage:

24 npx @aegisrunner/scan-runner --token <ci-token> [--api <base>]

26 --token <t> Project CI token (or env AEGIS_TOKEN). Manage → CI/CD.

27 --api <base> API base (or env AEGIS_API; default https://app.aegisrunner.com/api/v1)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin.mjsView on unpkg · L6

29Authed scans: set AEGIS_USERNAME / AEGIS_PASSWORD in the environment (never on

30the command line) — the runner logs in locally; credentials stay on your machine.

Lines 45-82javascript

45const api = val('--api') || process.env.AEGIS_API;

46if (api) process.env.AEGIS_API = api;

47// Credentials for authed scans come ONLY from the environment (never argv, to

48// avoid leaking via the process list). AEGIS_USERNAME / AEGIS_PASSWORD are read

49// by the executor directly.

runnerExecutor.mjsView file

Lines 4-44javascript

4// src/v2/utils/api-tracker.ts

5async function waitForPendingAPI(page, timeout = 8e3) {

6 try {

7 await page.waitForFunction(

Source & flagged code

5 flagged · loading source

bin.mjsView file

6// a dependency of THIS package. No Docker. L7: import { spawnSync } from 'node:child_process'; L8: import { createRequire } from 'node:module';

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code