registry / @agent-link/agent / 0.1.326

@agent-link/agent@0.1.326

AgentLink local agent CLI

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 90 file(s), 1.07 MB of source, external domains: cdn.jsdelivr.net, login.microsoftonline.com, msclaude.ai, www.apple.com

Source & flagged code

5 flagged

package.jsonView file

Lines 17-57json

17 "claude",

18 "claude-code",

19 "cli",

20 "ai-agent",

21 "remote-development"

22 ],

23 "type": "module",

24 "main": "dist/index.js",

25 "types": "dist/index.d.ts",

26 "files": [

27 "dist",

28 "launcher",

29 "scripts",

30 "worker"

31 ],

32 "bin": {

33 "agentlink-client": "dist/cli.js"

34 },

35 "scripts": {

36 "build": "tsc",

37 "postinstall": "node scripts/install-bridge.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 "prepublishOnly": "npm run build",

39 "dev": "tsx watch src/index.ts",

40 "start": "node dist/index.js"

41 },

42 "engines": {

43 "node": ">=18.0.0"

44 },

45 "dependencies": {

46 "@azure/msal-node": "^3.8.10",

47 "commander": "^12.0.0",

48 "cron-parser": "^5.5.0",

49 "js-yaml": "^4.1.1",

50 "marked": "^17.0.6",

51 "node-cron": "^4.2.1",

52 "node-pty": "^1.1.0",

53 "qrcode-terminal": "^0.12.0",

54 "tweetnacl": "^1.0.3",

55 "tweetnacl-util": "^0.15.1",

56 "ws": "^8.16.0"

57 },

dist/emergency-upgrade.jsView file

Lines 1-24javascript

1import { createHash } from 'crypto';

2import { mkdtempSync, rmSync, writeFileSync } from 'fs';

3import { tmpdir } from 'os';

4import { join, posix } from 'path';

launcher/launcher.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const os = require('os');

dist/service.jsView file

Lines 1-21javascript

1import { execFileSync } from 'child_process';

2import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'fs';

3import { dirname, join, resolve } from 'path';

4import { homedir } from 'os';

dist/connection.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agent-link/agent@0.1.329 matchedIdentity = npm:QGFnZW50LWxpbmsvYWdlbnQ:0.1.329 similarity = 0.921 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/connection.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code