registry / @agent-link/server / 0.1.499

@agent-link/server@0.1.499

AgentLink relay server

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No unconsented install-time or import-time attack behavior is established. After an explicit user start, the package runs a local HTTP/WebSocket relay for connected agents and browser clients; optional service persistence requires `agentlink-server service install`.

Static reason

No blocking static signals were detected.

Trigger

User runs `agentlink-server start`, `agentlink-server service install`, or `agentlink-server upgrade`.

Impact

Provides the package's stated remote-agent relay capability; no malicious side effect was confirmed.

Mechanism

User-invoked WebSocket relay, optional local service registration, and explicit npm self-upgrade.

Rationale

The observed process spawning, service creation, network use, and npm upgrade are explicit CLI features aligned with a relay-server package. Source inspection found no lifecycle-triggered mutation, covert collection/exfiltration, or concrete malicious chain.

Evidence

package.jsondist/index.jsdist/cli.jsdist/service.jsdist/ws-agent.jsdist/tunnel.jsdist/config.jsdist/state-persistence.jsdist/ws-client.jsdist/entra.jsdist/http.jsweb/dist/index.htmlweb/dist/assets/index-EXinN4za.jsweb/dist/assets/msalAuth-CNctxOXl.jsREADME.md

Network endpoints1

@agent-link/server@0.1.499

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code