registry / @agent-relay/cloud / 10.5.0

@agent-relay/cloud@10.5.0

Cloud SDK for Agent Relay — auth, workflow execution, and provider connections

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 197 KB of source, external domains: 127.0.0.1, agentrelay.com

Source & flagged code

3 flagged

dist/auth.jsView file

Lines 1-25javascript

1import { randomUUID } from 'node:crypto';

2import fs from 'node:fs/promises';

3import http from 'node:http';

4import os from 'node:os';

5import path from 'node:path';

6import { spawn } from 'node:child_process';

7import { setTimeout as delay } from 'node:timers/promises';

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L5

8import { buildApiUrl } from './api-client.js';

9import { CloudApiClient } from './api-client.js';

10import { appendAgentRelayTelemetryHeaders } from './telemetry-headers.js';

11import { AUTH_FILE_PATH, DEFAULT_REFRESH_TIMEOUT_MS, REFRESH_TOKEN_WINDOW_MS, REFRESH_WINDOW_MS, CloudAuthError, defaultApiUrl, } from './types.js';

12const AUTH_DIR_PATH = path.dirname(AUTH_FILE_PATH);

13const AUTH_LOCK_PATH = `${AUTH_FILE_PATH}.lock`;

14const AUTH_LOCK_RETRY_DELAY_MS = 50;

15const AUTH_LOCK_STALE_MS = 30_000;

16const AUTH_LOCK_TIMEOUT_MS = 30_000;

17const envBackedAuth = new WeakSet();

18function markEnvBackedAuth(auth) {

19 envBackedAuth.add(auth);

20 return auth;

21}

22function isEnvBackedAuth(auth) {

23 return envBackedAuth.has(auth);

24}

25function readEnvAuth(env = process.env) {

dist/lib/ssh-interactive.jsView file

Lines 36-76javascript

36 }

37 if (err.message.includes('ENOTFOUND') || err.message.includes('getaddrinfo')) {

38 return `Cannot resolve hostname: ${host}. Check network connectivity.`;

39 }

40 if (err.message.includes('ETIMEDOUT')) {

dist/workflows.jsView file

Lines 62-102javascript

62 const errors = result.logs

63 .filter((l) => l.level === 'error')

64 .map((l) => l.message)

65 .join('\n');

Source & flagged code

3 flagged · loading source

dist/auth.jsView file

5import path from 'node:path'; L6: import { spawn } from 'node:child_process'; L7: import { setTimeout as delay } from 'node:timers/promises';

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L5

dist/lib/ssh-interactive.jsView file

56* L57: * Wraps the command in `exec sh -c '…'` so the PTY closes cleanly when the L58: * target CLI exits (no shell-teardown race with a TUI's alt-screen flush)

High

Shell

Package source references shell execution.

dist/lib/ssh-interactive.jsView on unpkg · L56

dist/workflows.jsView file

82const { execSync } = await import('node:child_process'); L83: execSync('npx --yes esbuild --loader=ts', { L84: input: content,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/workflows.jsView on unpkg · L82

Findings

3 High3 Medium5 Low

HighChild Processdist/auth.js

HighShelldist/lib/ssh-interactive.js

HighRuntime Package Installdist/workflows.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/auth.jsView file

Lines 1-25javascript

1import { randomUUID } from 'node:crypto';

2import fs from 'node:fs/promises';

3import http from 'node:http';

4import os from 'node:os';

5import path from 'node:path';

6import { spawn } from 'node:child_process';

7import { setTimeout as delay } from 'node:timers/promises';

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L5

8import { buildApiUrl } from './api-client.js';

9import { CloudApiClient } from './api-client.js';

10import { appendAgentRelayTelemetryHeaders } from './telemetry-headers.js';

11import { AUTH_FILE_PATH, DEFAULT_REFRESH_TIMEOUT_MS, REFRESH_TOKEN_WINDOW_MS, REFRESH_WINDOW_MS, CloudAuthError, defaultApiUrl, } from './types.js';

12const AUTH_DIR_PATH = path.dirname(AUTH_FILE_PATH);

13const AUTH_LOCK_PATH = `${AUTH_FILE_PATH}.lock`;

14const AUTH_LOCK_RETRY_DELAY_MS = 50;

15const AUTH_LOCK_STALE_MS = 30_000;

16const AUTH_LOCK_TIMEOUT_MS = 30_000;

17const envBackedAuth = new WeakSet();

18function markEnvBackedAuth(auth) {

19 envBackedAuth.add(auth);

20 return auth;

21}

22function isEnvBackedAuth(auth) {

23 return envBackedAuth.has(auth);

24}

25function readEnvAuth(env = process.env) {

dist/lib/ssh-interactive.jsView file

Lines 36-76javascript

36 }

37 if (err.message.includes('ENOTFOUND') || err.message.includes('getaddrinfo')) {

38 return `Cannot resolve hostname: ${host}. Check network connectivity.`;

39 }

40 if (err.message.includes('ETIMEDOUT')) {

dist/workflows.jsView file

Lines 62-102javascript

62 const errors = result.logs

63 .filter((l) => l.level === 'error')

64 .map((l) => l.message)

65 .join('\n');