registry / @agentconnect.md/daemon / 1.1.0

@agentconnect.md/daemon@1.1.0

AgentConnect daemon — edge message + agent execution unit

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 1.73 MB of source, external domains: cdn.agentclientprotocol.com, datatracker.ietf.org, github.com, github.com.helper, github.com.usehttppath, json-schema.org, raw.githubusercontent.com, www.apple.com

Oversized source lightweight scan

dist/index.js2.47 MB file, sampled 256 KB

FilesystemEnvironmentVarsHighEntropyStrings

dist/run-foreground-HOaZv3Rp.js10.6 MB file, sampled 256 KB

FilesystemNetworkEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

6 flagged

dist/schemas-CQkO9hC5.jsView file

Lines 123-163javascript

123 const mergedDescriptors = {};

124 for (const def of defs) {

125 const descriptors = Object.getOwnPropertyDescriptors(def);

126 Object.assign(mergedDescriptors, descriptors);

127 }

128 return Object.defineProperties({}, mergedDescriptors);

129}

130function esc(str) {

131 return JSON.stringify(str);

132}

133function slugify(input) {

134 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

135}

136const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

137function isObject(data) {

138 return typeof data === "object" && data !== null && !Array.isArray(data);

139}

140const allowsEval = /* @__PURE__*/ cached(() => {

141 if (globalConfig.jitless) return false;

142 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

143 try {

144 new Function("");

145 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schemas-CQkO9hC5.jsView on unpkg · L143

146 } catch (_) {

147 return false;

148 }

149});

150function isPlainObject(o) {

151 if (isObject(o) === false) return false;

152 const ctor = o.constructor;

153 if (ctor === void 0) return true;

154 if (typeof ctor !== "function") return true;

155 const prot = ctor.prototype;

156 if (isObject(prot) === false) return false;

157 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

158 return true;

159}

160function shallowClone(o) {

161 if (isPlainObject(o)) return { ...o };

162 if (Array.isArray(o)) return [...o];

163 if (o instanceof Map) return new Map(o);

dist/stdio-DnS8WcXi.jsView file

Lines 5364-5404javascript

5364 this.localRefs = env.localRefs;

5365 this.meta = env.meta;

5366 this.$async = schema === null || schema === void 0 ? void 0 : schema.$async;

dist/service-BQVw7wbz.jsView file

Lines 1-23javascript

1import { a as logsDir, l as resolveRoot, n as daemonLogPath } from "./paths-DEcUO8lC.js";

2import { dirname, join } from "node:path";

3import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

4import { execFile } from "node:child_process";

5import

dist/acp-host-JWM8mwJV.jsView file

Lines 1-27javascript

1import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CE-6LUnI.js";

2import { t as require_src$1 } from "./src-DDtlVutj.js";

3import { T as NEVER, _ as record, a as array, b as unknown, d as literal, l as int, m as

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2590022 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2590022 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/schemas-CQkO9hC5.jsView file

143try { L144: new Function(""); L145: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schemas-CQkO9hC5.jsView on unpkg · L143

dist/stdio-DnS8WcXi.jsView file

5384ref: validation_error_1.default, L5385: code: (0, codegen_1._)`require("ajv/dist/runtime/validation_error").default` L5386: });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/stdio-DnS8WcXi.jsView on unpkg · L5384

dist/service-BQVw7wbz.jsView file

3import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; L4: import { execFile } from "node:child_process"; L5: import { homedir } from "node:os"; ... L9: const defaultExec = (cmd, args) => new Promise((resolve) => { L10: execFile(cmd, args, (err, stdout, stderr) => { L11: resolve({ ... L20: /** macOS launchd controller. Writes a LaunchAgent plist that runs L21: * `<node> <cli-entry> run`, and drives it with `launchctl bootstrap/bootout` L22: * (falling back to legacy `load/unload` on older macOS). */ ... L234: const root = resolveRoot(opts.root); L235: return pickController(opts.platform ?? process.platform, { L236: root,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service-BQVw7wbz.jsView on unpkg · L3

dist/acp-host-JWM8mwJV.jsView file

7import { accessSync, constants, existsSync, mkdirSync, promises, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs"; L8: import { spawn } from "child_process"; L9: import { EventEmitter } from "node:events"; ... L37: function platformKey() { L38: const os = process.platform === "win32" ? "windows" : process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null; L39: const arch = process.arch === "arm64" ? "aarch64" : process.arch === "x64" ? "x86_64" : null; ... L73: } L74: const REGISTRY_URL = "https://cdn.agentclientprotocol.com/registry/v1/latest/registry.json"; L75: const DEFAULT_TIMEOUT_MS = 4500; ... L79: try { L80: return RegistryDocSchema.parse(JSON.parse(readFileSync(file, "utf8"))); L81: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/acp-host-JWM8mwJV.jsView on unpkg · L7

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2590022 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2590022 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Findings

2 High6 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/acp-host-JWM8mwJV.js

HighOversized Source Filedist/index.js

MediumDynamic Requiredist/stdio-DnS8WcXi.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/service-BQVw7wbz.js

MediumOversized Cli Entrypointdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/schemas-CQkO9hC5.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/schemas-CQkO9hC5.jsView file

Lines 123-163javascript

123 const mergedDescriptors = {};

124 for (const def of defs) {

125 const descriptors = Object.getOwnPropertyDescriptors(def);

126 Object.assign(mergedDescriptors, descriptors);

127 }

128 return Object.defineProperties({}, mergedDescriptors);

129}

130function esc(str) {

131 return JSON.stringify(str);

132}

133function slugify(input) {

134 return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");

135}

136const captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {};

137function isObject(data) {

138 return typeof data === "object" && data !== null && !Array.isArray(data);

139}

140const allowsEval = /* @__PURE__*/ cached(() => {

141 if (globalConfig.jitless) return false;

142 if (typeof navigator !== "undefined" && navigator?.userAgent?.includes("Cloudflare")) return false;

143 try {

144 new Function("");

145 return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/schemas-CQkO9hC5.jsView on unpkg · L143

146 } catch (_) {

147 return false;

148 }

149});

150function isPlainObject(o) {

151 if (isObject(o) === false) return false;

152 const ctor = o.constructor;

153 if (ctor === void 0) return true;

154 if (typeof ctor !== "function") return true;

155 const prot = ctor.prototype;

156 if (isObject(prot) === false) return false;

157 if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) return false;

158 return true;

159}

160function shallowClone(o) {

161 if (isPlainObject(o)) return { ...o };

162 if (Array.isArray(o)) return [...o];

163 if (o instanceof Map) return new Map(o);

dist/stdio-DnS8WcXi.jsView file

Lines 5364-5404javascript

5364 this.localRefs = env.localRefs;

5365 this.meta = env.meta;

5366 this.$async = schema === null || schema === void 0 ? void 0 : schema.$async;

dist/service-BQVw7wbz.jsView file

Lines 1-23javascript

1import { a as logsDir, l as resolveRoot, n as daemonLogPath } from "./paths-DEcUO8lC.js";

2import { dirname, join } from "node:path";

3import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

4import { execFile } from "node:child_process";

5import

dist/acp-host-JWM8mwJV.jsView file

Lines 1-27javascript

1import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CE-6LUnI.js";

2import { t as require_src$1 } from "./src-DDtlVutj.js";

3import { T as NEVER, _ as record, a as array, b as unknown, d as literal, l as int, m as

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 2590022 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2590022 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg