registry / @aiscene/aiserver / 2.0.5

@aiscene/aiserver@2.0.5

AI automation server with device management, task scheduling, and debug capabilities

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 84 file(s), 901 KB of source, external domains: 127.0.0.1, autobots-bk.jd.local, clawai.jd.com, modelservice.jdcloud.com, nethp-test.jd.com, opentest.jd.com, opentestai.jd.com, proxy-pc.jd.com, ssa.jd.com, storage.jd.com

Source & flagged code

4 flagged

dist/.envView file

32patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L32: OPENAI_API_KEY=<redacted:0 empty> L47: MIDSCENE_MODEL_API_KEY=<redacted:39 token-like> L48: MIDSCENE_MODEL_NAME=<redacted:29 token-like> L49: MIDSCENE_MODEL_FAMILY=<redacted:22 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/task/guada-browser-rpc-client.jsView file

Lines 262-302javascript

262 }

263 async click(params) {

264 const record = this.getWindow(params.window_id || params.windowId);

265 if (!params.selector)

266 throw new Error('selector is required');

267 await record.page.click(params.selector, { timeout: 15000 });

268 await record.page.waitForLoadState('domcontentloaded', { timeout: 10000 }).catch(() => undefined);

269 return this.pageBasicResult(record.page, record.id);

270 }

271 async input(params) {

272 const record = this.getWindow(params.window_id || params.windowId);

273 if (!params.selector)

274 throw new Error('selector is required');

275 await record.page.fill(params.selector, String(params.value ?? ''), { timeout: 15000 });

276 return this.pageBasicResult(record.page, record.id);

277 }

278 async runJs(params) {

279 const record = this.getWindow(params.window_id || params.windowId);

280 if (!params.code)

281 throw new Error('code is required');

282 const result = await record.page.evaluate(async (code) => {

283 const fn = new Function(`return (async () => { ${code} })();`);

284 return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/task/guada-browser-rpc-client.jsView on unpkg · L282

285 }, String(params.code));

286 return {

287 success: true,

288 windowId: record.id,

289 window_id: record.id,

290 result,

291 };

292 }

293 async listWindows(params) {

294 const sessionId = params.session_id || params.sessionId;

295 const windows = await Promise.all(Array.from(this.windows.values())

296 .filter((record) => !sessionId || record.sessionId === sessionId)

297 .map(async (record) => ({

298 windowId: record.id,

299 window_id: record.id,

300 title: await record.page.title().catch(() => ''),

301 url: record.page.url(),

302 shared: record.shared,

dist/executor/ios-wda-manager.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import fs from 'fs';

3import net from 'net';

4import os from 'os';

dist/web/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aiscene/aiserver@2.0.4 matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.0.4 similarity = 0.845 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/.envView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code