registry / @agentdock/daemon / 0.0.58

@agentdock/daemon@0.0.58

⚠ Under review

PC daemon + CLI for AgentDock — ACP abstraction, TransportHandler, process management

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 161 file(s), 353 KB of source, external domains: 127.0.0.1, agentdock-api.yungujia.com, app-api.yark.ai, ccpark-api.yungujia.com, claude.ai, docs.github.com, opencode.ai, raw.githubusercontent.com, registry.npmjs.org, www.apple.com

Source & flagged code

6 flagged

dist/processTree.jsView file

Lines 1-6javascript

1"use strict";import{exec as t,execSync as c}from"node:child_process";const r=process.platform==="win32";export function killProcessTree(e){r&&e.pid?t(`taskkill /T /F /PID ${e.pid}`,s=>{s&&process.stderr.write(`taskkill failed for PID ${e.pid}: ${s.message}

2`)}):e.kill("SIGTERM")}export function killProcessTreeByPid(e){r?t(`taskkill /T /F /PID ${e}`,s=>{s&&process.stderr.write(`taskkill failed for PID ${e}: ${s.message}

High

Child Process

Package source references child process execution.

dist/processTree.jsView on unpkg · L1

3`)}):process.kill(e,"SIGTERM")}export function killOwnChildProcessTrees(e){if(r)try{const s=c(`wmic process where "ParentProcessId=${process.pid}" get ProcessId /format:csv`,{encoding:"utf8",timeout:3e3});for(const l of s.split(`

4`)){const i=l.trim().split(",").pop();if(i&&/^\d+$/.test(i)&&Number(i)!==process.pid){if(e?.has(Number(i)))continue;t(`taskkill /T /F /PID ${i}`,o=>{o&&process.stderr.write(

5`)})}}}catch{}}

dist/subagentIds.jsView file

Lines 1-2javascript

1"use strict";import{createHash as t}from"node:crypto";export function makeStableSubagentId(e){return`c${t("sha1").update(e).digest("hex").slice(0,23)}`}

Low

dist/autostart.jsView file

Lines 1-7javascript

dist/ensureDaemon.jsView file

Lines 1-2javascript

1"use strict";import{spawn as w}from"node:child_process";import d from"node:path";import{fileURLToPath as y}from"node:url";import{readDaemonState as m}from"./state.js";import{getStatePath as T}from"./paths.js";import{stripSessionEnv as P}from

Source & flagged code

6 flagged · loading source

dist/processTree.jsView file

1"use strict";import{exec as t,execSync as c}from"node:child_process";const r=process.platform==="win32";export function killProcessTree(e){r&&e.pid?t(`taskkill /T /F /PID ${e.pid}`... L2: `)}):e.kill("SIGTERM")}export function killProcessTreeByPid(e){r?t(`taskkill /T /F /PID ${e}`,s=>{s&&process.stderr.write(`taskkill failed for PID ${e}: ${s.message}

High

Child Process

Package source references child process execution.

dist/processTree.jsView on unpkg · L1

dist/subagentIds.jsView file

1"use strict";import{createHash as t}from"node:crypto";export function makeStableSubagentId(e){return`c${t("sha1").update(e).digest("hex").slice(0,23)}`}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/subagentIds.jsView on unpkg · L1

dist/autostart.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agentdock/daemon@0.0.54 matchedIdentity = npm:QGFnZW50ZG9jay9kYWVtb24:0.0.54 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/autostart.jsView on unpkg

1"use strict";import{execSync as o}from"node:child_process";import c from"node:fs";import a from"node:path";import{fileURLToPath as $}from"node:url";import{isEnterprise as v}from"@a... L2: `)+` ... L5: `)+` L6: `}export function buildRegCommand(e,t,n){const r=(n?`"${e}" "--import" "tsx" "${t}"`:`"${e}" "${t}"`).replace(/"/g,'\\"');return`reg add HKCU\\Software\\Microsoft\\Windows\\Current...

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L1

dist/ensureDaemon.jsView file

1"use strict";import{spawn as w}from"node:child_process";import d from"node:path";import{fileURLToPath as y}from"node:url";import{readDaemonState as m}from"./state.js";import{getSta...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ensureDaemon.jsView on unpkg · L1

1"use strict";import{spawn as w}from"node:child_process";import d from"node:path";import{fileURLToPath as y}from"node:url";import{readDaemonState as m}from"./state.js";import{getSta...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/ensureDaemon.jsView on unpkg · L1

Findings

1 Critical3 High3 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/autostart.js

HighChild Processdist/processTree.js

HighSame File Env Network Executiondist/ensureDaemon.js

HighCommand Output Exfiltrationdist/ensureDaemon.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart.js

LowScripts Present

LowWeak Cryptodist/subagentIds.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/processTree.jsView file

Lines 1-6javascript

2`)}):e.kill("SIGTERM")}export function killProcessTreeByPid(e){r?t(`taskkill /T /F /PID ${e}`,s=>{s&&process.stderr.write(`taskkill failed for PID ${e}: ${s.message}

High

Child Process

Package source references child process execution.

dist/processTree.jsView on unpkg · L1

4`)){const i=l.trim().split(",").pop();if(i&&/^\d+$/.test(i)&&Number(i)!==process.pid){if(e?.has(Number(i)))continue;t(`taskkill /T /F /PID ${i}`,o=>{o&&process.stderr.write(

5`)})}}}catch{}}

dist/subagentIds.jsView file

Lines 1-2javascript

1"use strict";import{createHash as t}from"node:crypto";export function makeStableSubagentId(e){return`c${t("sha1").update(e).digest("hex").slice(0,23)}`}

Low

dist/autostart.jsView file

Lines 1-7javascript

dist/ensureDaemon.jsView file

Lines 1-2javascript