registry / @agentex/agent / 0.0.24

@agentex/agent@0.0.24

Programmatic execution of AI coding agents (Claude Code, Codex, OpenClaw)

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 68 file(s), 503 KB of source

Source & flagged code

1 flagged

dist/providers/opencode/server.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3// Ref-counted pool so parallel sessions sharing the same binary + cwd + args +

4// env reuse one `opencode serve` process. Disposed when the last session

5// releases it.

6const pool = new Map();

7// Key on binary + cwd + prefixArgs + env so sessions with different auth/config

8// (a different API key, different flags) never silently share the same daemon.

9function keyFor(binary, cwd, prefixArgs, env) {

10 const h = createHash("sha1");

11 h.update(JSON.stringify(prefixArgs));

12 h.update("");

13 for (const k of Object.keys(env).sort())

14 h.update(`${k}=${env[k]}\n`);

15 return `${binary}${cwd}${h.digest("hex")}`;

16}

17async function waitForHealth(url, timeoutMs) {

18 const deadline = Date.now() + timeoutMs;

19 while (Date.now() < deadline) {

20 try {

21 const res = await fetch(`${url}/global/health`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/opencode/server.jsView on unpkg · L1

Source & flagged code

1 flagged · loading source

dist/providers/opencode/server.jsView file

1import { spawn } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L20: try { L21: const res = await fetch(`${url}/global/health`); L22: if (res.ok) ... L56: clearTimeout(timer); L57: proc.stdout?.off("data", onData); L58: proc.stderr?.off("data", onData);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/opencode/server.jsView on unpkg · L1

Findings

2 Medium4 Low

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptodist/providers/opencode/server.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/providers/opencode/server.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3// Ref-counted pool so parallel sessions sharing the same binary + cwd + args +

4// env reuse one `opencode serve` process. Disposed when the last session

5// releases it.

6const pool = new Map();

7// Key on binary + cwd + prefixArgs + env so sessions with different auth/config

8// (a different API key, different flags) never silently share the same daemon.

9function keyFor(binary, cwd, prefixArgs, env) {

10 const h = createHash("sha1");

11 h.update(JSON.stringify(prefixArgs));

12 h.update("");

13 for (const k of Object.keys(env).sort())

14 h.update(`${k}=${env[k]}\n`);

15 return `${binary}${cwd}${h.digest("hex")}`;

16}

17async function waitForHealth(url, timeoutMs) {

18 const deadline = Date.now() + timeoutMs;

19 while (Date.now() < deadline) {

20 try {

21 const res = await fetch(`${url}/global/health`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/providers/opencode/server.jsView on unpkg · L1