registry / @ai-support-agent/cli / 0.4.9

@ai-support-agent/cli@0.4.9

AI Support Agent CLI client

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 193 file(s), 1.52 MB of source, external domains: api.ai-support-agent.com, api.anthropic.com, app.ai-support-agent.com, dev.mysql.com, schemas.microsoft.com, www.apple.com, www.postgresql.org

Source & flagged code

8 flagged

ansible/roles/database/tasks/main.ymlView file

Lines 76-120yaml

76# `check_implicit_admin` tries first. Setting `password` here switches

77# root@localhost to password auth, so a *second* run can no longer connect

78# as the implicit admin; `check_implicit_admin` then falls back to

79# connecting as `login_user`/`login_password` (the same, now-current,

80# `db_root_password`), which succeeds and is a no-op since the password

81# already matches. Without this, a second run would fail outright once the

82# implicit-admin connection stops working. This mirrors the "Handle multiple

83# non-idempotent password changed states" example in the upstream

84# community.mysql.mysql_user documentation (ansible.mysql.mysql_user shares

85# the same module interface).

86- name: "database : Set MySQL root password"

87 # `no_log` is required (the password is a module parameter), but a `no_log`

88 # failure is reported as a bare "<task> failed": Ansible replaces the whole

89 # result with `censored` and drops `msg` entirely, so the runner has nothing

90 # left to show. Run to completion instead and let the next task report the

91 # reason — the same "no_log + separate diagnostic" pattern the codex /

92 # gitlab_runner / github_runner / tailscale / k3s tasks already use.

93 ansible.mysql.mysql_user:

94 name: root

95 host: localhost

96 password: "{{ db_root_password }}"

Medium

Secret Pattern

Package contains a possible secret pattern.

ansible/roles/database/tasks/main.ymlView on unpkg · L96

97 login_unix_socket: /var/run/mysqld/mysqld.sock

98 check_implicit_admin: true

99 login_user: root

100 login_password: "{{ db_root_password }}"

Medium

Secret Pattern

Hardcoded password in ansible/roles/database/tasks/main.yml

ansible/roles/database/tasks/main.ymlView on unpkg · L100

101 when: (db_type | default('')) == 'mysql' and db_root_password is defined

102 register: db_mysql_root_password_result

103 # `ignore_errors`, NOT `failed_when: false`: the latter forces the task's

104 # failure verdict to false and that verdict is what lands in the registered

105 # result, so `.failed` would read False even when the module failed and the

106 # diagnostic below would never fire (verified: a failing module registered

107 # with `failed_when: false` reports `failed=False`, with `ignore_errors: true`

108 # it reports `failed=True`). The shell-based tasks in the other roles can use

109 # `failed_when: false` because they inspect the raw `.rc` instead; a Python

110 # module has no rc.

111 ignore_errors: true

112 no_log: true

113

114- name: "database : Fail if the MySQL root password could not be set (password-safe diagnostic)"

115 # Not `no_log`, so this message is actually delivered. It reports the module's

116 # own error, which describes the connection/auth problem ("Access denied ...",

117 # "unable to connect ...") and never echoes the password back — mysql_user

118 # takes the password as a parameter and does not include parameters in its

119 # error text.

120 ansible.builtin.fail:

Lines 140-178yaml

140- name: "database : Enable and start PostgreSQL"

141 ansible.builtin.service:

142 name: postgresql

143 state: started

144 enabled: true

145 when: (db_type | default('')) == 'postgresql'

dist/ws-reconnect.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.attemptReconnect = attemptReconnect;

4const logger_1 = require("./logger"

dist/terminal/terminal-session.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.

docker/bashrc-extra.shView file

•path = docker/bashrc-extra.sh kind = build_helper sizeBytes = 1069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/bashrc-extra.shView on unpkg

dist/constants.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ai-support-agent/cli@0.4.7 matchedIdentity = npm:QGFpLXN1cHBvcnQtYWdlbnQvY2xp:0.4.7 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/constants.jsView on unpkg

Source & flagged code

8 flagged · loading source

ansible/roles/database/tasks/main.ymlView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code