registry / @agentiny-ai/app / 0.0.154

@agentiny-ai/app@0.0.154

Run Agentiny locally — one command, no clone needed

Static Scan Results

scanned 56m ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 5.25 MB of source, external domains: 127.0.0.1, agentiny.tech, json-schema.org, registry.npmjs.org

Source & flagged code

7 flagged

dist/index.jsView file

72import { Command } from "commander"; L73: import { execSync as execSync4, spawnSync, spawn as spawnAsync } from "child_process"; L74: import { join as join8, dirname as dirname3 } from "path";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L72

72Cross-file remote execution chain: dist/index.js spawns dist/cli/index.js; helper contains network access plus dynamic code execution. L72: import { Command } from "commander"; L73: import { execSync as execSync4, spawnSync, spawn as spawnAsync } from "child_process"; L74: import { join as join8, dirname as dirname3 } from "path"; ... L79: import { execSync } from "child_process"; L80: import { createConnection } from "net"; L81: function checkNodeVersion() { ... L91: try { L92: const check = process.platform === "win32" ? `where ${type}` : `which ${type}`; L93: execSync(check, { stdio: "ignore" }); ... L139: function resolveBaseDir() { L140: if (process.env.ALOOK_PROJECT_ROOT) { L141: return join(process.env.ALOOK_PROJECT_ROOT, ".agentiny", "self-hosted");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L72

dist/cli/index.jsView file

87headers["X-Workspace-ID"] = this.workspaceId; L88: const res = await fetch(this.baseURL + path, { L89: method, L90: headers, L91: body: body ? JSON.stringify(body) : undefined L92: }); L93: if (!res.ok) { L94: const text = await res.text(); L95: throw new Error(`HTTP ${res.status}: ${text}`); ... L200: ]; L201: var POLL_INTERVAL_MS = Number(process.env.POLL_INTERVAL_MS) || 3000; L202: var OFFLINE_THRESHOLD_MS = Number(process.env.OFFLINE_THRESHOLD_MS) || 30000;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L87

dist/cli/meeting-runner.jsView file

Lines 342-382javascript

342 `${process.env.LOCALAPPDATA}\\Google\\Chrome\\Application\\chrome.exe`

343 ]

344};

345function findChrome() {

346

bundled/web/.open-next/assets/_next/static/media/KaTeX_Main-Italic.0afv392dj4w59.woffView file

•path = bundled/web/.open-next/assets/_next/static/media/KaTeX_Main-Italic.0afv392dj4w59.woff kind = high_entropy_blob sizeBytes = 19676 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

bundled/web/.open-next/assets/_next/static/media/KaTeX_Main-Italic.0afv392dj4w59.woffView on unpkg

bundled/web/.open-next/middleware/handler.mjsView file

•path = bundled/web/.open-next/middleware/handler.mjs kind = payload_in_excluded_dir sizeBytes = 2245827 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

bundled/web/.open-next/middleware/handler.mjsView on unpkg

•path = bundled/web/.open-next/middleware/handler.mjs kind = oversized_source_file sizeBytes = 2245827 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bundled/web/.open-next/middleware/handler.mjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code