registry / @ai-setting/agent-bounty / 0.4.3

@ai-setting/agent-bounty@0.4.3

AI Agent Bounty System — Task publishing, grabbing, and communication platform. v0.4.1: upgrade roy deps (cli 1.5.103, coder-harness 1.5.50, core 1.5.99).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 80 file(s), 1.49 MB of source, external domains: accounts.google.com, api.nodemailer.com, bounty.example.com, bounty.tongagents.example.com, ethereal.email, github.com, nodemailer.com, yargs.js.org

Source & flagged code

4 flagged

dist/bin/bounty.jsView file

Lines 31-95javascript

31 return to;

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(name, newValue) {

36 this[name] = __returnValue.bind(null, newValue);

37}

38var __export = (target, all) => {

39 for (var name in all)

40 __defProp(target, name, {

41 get: all[name],

42 enumerable: true,

43 configurable: true,

44 set: __exportSetter.bind(all, name)

45 });

46};

47var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

48var __require = import.meta.require;

50// ../../node_modules/dotenv/lib/main.js

51var require_main = __commonJS((exports, module) => {

52 var fs = __require("fs");

53 var path = __require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/bounty.jsView on unpkg · L51

54 var os = __require("os");

55 var crypto = __require("crypto");

56 var TIPS = [

57 "\u25C8 encrypted .env [www.dotenvx.com]",

58 "\u25C8 secrets for agents [www.dotenvx.com]",

59 "\u2301 auth for agents [www.vestauth.com]",

60 "\u2318 custom filepath { path: '/custom/path/.env' }",

61 "\u2318 enable debugging { debug: true }",

62 "\u2318 override existing { override: true }",

63 "\u2318 suppress logs { quiet: true }",

64 "\u2318 multiple files { path: ['.env.local', '.env'] }"

65 ];

66 function _getRandomTip() {

67 return TIPS[Math.floor(Math.random() * TIPS.length)];

68 }

69 function parseBoolean(value) {

70 if (typeof value === "string") {

71 return !["false", "0", "no", "off", ""].includes(value.toLowerCase());

72 }

73 return Boolean(value);

74 }

75 function supportsAnsi() {

76 return process.stdout.isTTY;

77 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/bounty.jsView on unpkg · L75

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/bounty.jsView on unpkg · L75

78 function dim(text) {

79 return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;

80 }

81 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"]

82 function parse(src) {

83 const obj = {};

84 let lines = src.toString();

85 lines = lines.replace(/\r\n?/mg, `

86`);

87 let match;

88 while ((match = LINE.exec(lines)) != null) {

89 const key = match[1];

90 let value = match[2] || "";

91 value = value.trim();

92 const maybeQuote = value[0];

93 value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");

94 if (maybeQuote === '"') {

95 value = value.replace(/\\n/g, `

Lines 6613-6653javascript

6613 }

6614 if (!agentColumnNames.includes("address")) {

6615 this.db.run(`ALTER TABLE agents ADD COLUMN address TEXT`);

6616 }

6617 this.db.run(`

6618 CREATE TABLE IF NOT EXISTS verifications (

6619 id TEXT PRIMARY KEY,

6620 agent_id TEXT NOT NULL,

Source & flagged code

4 flagged · loading source

dist/bin/bounty.jsView file

6633} L6634: exec(sql) { L6635: this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/bin/bounty.jsView on unpkg · L6633

75Cross-file remote execution chain: dist/bin/bounty.js spawns dist/server/server.js; helper contains network access plus dynamic code execution. L75: function supportsAnsi() { L76: return process.stdout.isTTY; L77: } ... L108: if (!result.parsed) { L109: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L110: err.code = "MISSING_DATA"; ... L142: } L143: if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) { L144: return process.env.DOTENV_KEY; ... L193: } else { L194: possibleVaultPath = path.resolve(process.cwd(), ".env.vault"); L195: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/bounty.jsView on unpkg · L75

51var require_main = __commonJS((exports, module) => { L52: var fs = __require("fs"); L53: var path = __require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/bounty.jsView on unpkg · L51

75function supportsAnsi() { L76: return process.stdout.isTTY; L77: } ... L108: if (!result.parsed) { L109: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L110: err.code = "MISSING_DATA"; ... L142: } L143: if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) { L144: return process.env.DOTENV_KEY; ... L193: } else { L194: possibleVaultPath = path.resolve(process.cwd(), ".env.vault"); L195: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/bounty.jsView on unpkg · L75

Findings

3 High5 Medium5 Low

HighChild Processdist/bin/bounty.js

HighShell

HighCross File Remote Execution Contextdist/bin/bounty.js

MediumDynamic Requiredist/bin/bounty.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/bin/bounty.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/bin/bounty.jsView file

Lines 31-95javascript

31 return to;

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(name, newValue) {

36 this[name] = __returnValue.bind(null, newValue);

37}

38var __export = (target, all) => {

39 for (var name in all)

40 __defProp(target, name, {

41 get: all[name],

42 enumerable: true,

43 configurable: true,

44 set: __exportSetter.bind(all, name)

45 });

46};

47var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);

48var __require = import.meta.require;

50// ../../node_modules/dotenv/lib/main.js

51var require_main = __commonJS((exports, module) => {

52 var fs = __require("fs");

53 var path = __require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/bounty.jsView on unpkg · L51

54 var os = __require("os");

55 var crypto = __require("crypto");

56 var TIPS = [

57 "\u25C8 encrypted .env [www.dotenvx.com]",

58 "\u25C8 secrets for agents [www.dotenvx.com]",

59 "\u2301 auth for agents [www.vestauth.com]",

60 "\u2318 custom filepath { path: '/custom/path/.env' }",

61 "\u2318 enable debugging { debug: true }",

62 "\u2318 override existing { override: true }",

63 "\u2318 suppress logs { quiet: true }",

64 "\u2318 multiple files { path: ['.env.local', '.env'] }"

65 ];

66 function _getRandomTip() {

67 return TIPS[Math.floor(Math.random() * TIPS.length)];

68 }

69 function parseBoolean(value) {

70 if (typeof value === "string") {

71 return !["false", "0", "no", "off", ""].includes(value.toLowerCase());

72 }

73 return Boolean(value);

74 }

75 function supportsAnsi() {

76 return process.stdout.isTTY;

77 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/bounty.jsView on unpkg · L75

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/bounty.jsView on unpkg · L75

78 function dim(text) {

79 return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;

80 }

81 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"]

82 function parse(src) {

83 const obj = {};

84 let lines = src.toString();

85 lines = lines.replace(/\r\n?/mg, `

86`);

87 let match;

88 while ((match = LINE.exec(lines)) != null) {

89 const key = match[1];

90 let value = match[2] || "";

91 value = value.trim();

92 const maybeQuote = value[0];

93 value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");

94 if (maybeQuote === '"') {

95 value = value.replace(/\\n/g, `

Lines 6613-6653javascript

6613 }

6614 if (!agentColumnNames.includes("address")) {

6615 this.db.run(`ALTER TABLE agents ADD COLUMN address TEXT`);

6616 }

6617 this.db.run(`

6618 CREATE TABLE IF NOT EXISTS verifications (

6619 id TEXT PRIMARY KEY,

6620 agent_id TEXT NOT NULL,