registry / @aiscene/aiserver / 2.1.2

@aiscene/aiserver@2.1.2

⚠ Under review

AI automation server with device management, task scheduling, and debug capabilities

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 963 KB of source, external domains: 127.0.0.1, autobots-bk.jd.local, clawai.jd.com, modelservice.jdcloud.com, nethp-test.jd.com, opentest.jd.com, opentestai.jd.com, proxy-pc.jd.com, ssa.jd.com, storage.jd.com

Source & flagged code

10 flagged

dist/.envView file

Lines 12-49text

12AISERVER_TASK_POLL_INTERVAL=3000

13AISERVER_TASK_API_URL=http://nethp-test.jd.com

14AISERVER_TASK_MAX_CONCURRENT=3

15AISERVER_TASK_TIMEOUT=1200000

17# Node

18AISERVER_NODE_PORT=8002

19AISERVER_NODE_TYPE=executor

20AISERVER_NODE_VERSION=1.0.0

21AISERVER_NODE_ENVIRONMENT=prod

22AISERVER_NODE_WEIGHT=1

23AISERVER_NODE_SUPPORTED_TAGS=android,ios,web

24AISERVER_NODE_REGION=

25AISERVER_NODE_DESCRIPTION=

26AISERVER_NODE_REGISTER_URL=http://nethp-test.jd.com/rest/execution-nodes/register

27AISERVER_NODE_HEARTBEAT_URL=http://nethp-test.jd.com/rest/execution-nodes/heartbeat

28AISERVER_NODE_HEARTBEAT_INTERVAL=30000

30# AI

31OPENAI_BASE_URL=

32OPENAI_API_KEY=

33MIDSCENE_MODEL_NAME=

34MIDSCENE_USE_QWEN3_VL=1

36# Storage

37AISERVER_DB_PATH=./data/aiserver.db

39# Callback

40AISERVER_STATUS_UPDATE_URL=http://nethp-test.jd.com/rest/execution-queue/tasks

41AISERVER_REPORT_UPLOAD_URL=http://nethp-test.jd.com/rest/execution-callback/result-file

42AISERVER_DEVICE_HEARTBEAT_URL=http://nethp-test.jd.com/rest/mobile-devices/heartbeat

43AISERVER_DEVICE_STATUS_UPDATE_URL=http://nethp-test.jd.com/rest/mobile-devices

46MIDSCENE_MODEL_BASE_URL=https://modelservice.jdcloud.com/v1

47MIDSCENE_MODEL_API_KEY=pk-485b2b56-7334-4bed-bd74-09bb42ca3baf

48MIDSCENE_MODEL_NAME=doubao-seed-1-6-vision-250815

49MIDSCENE_MODEL_FAMILY=vlm-ui-tars-doubao-1.5

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/task/guada-browser-rpc-client.jsView file

Lines 272-312javascript

272 }

273 async click(params) {

274 const record = this.getWindow(params.window_id || params.windowId);

275 if (!params.selector)

dist/task/local-code-service.jsView file

Lines 1-21javascript

1import { execFile } from 'child_process';

2import { createHash } from 'crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/task/local-code-service.jsView on unpkg · L1

3import fs from 'fs/promises';

dist/executor/ios-wda-manager.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import fs from 'fs';

3import net from 'net';

4import os from 'os';

dist/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/web/server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/server.jsView on unpkg

dist/goose-runtime/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/goose-runtime/runtime.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/goose-runtime/runtime.jsView on unpkg

dist/task/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/task/scheduler.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/task/scheduler.jsView on unpkg

dist/scrcpy/server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/scrcpy/server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scrcpy/server.jsView on unpkg

dist/debug/websocket-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aiscene/aiserver@2.1.1 matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.1 similarity = 0.922 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/debug/websocket-server.jsView on unpkg

Source & flagged code

10 flagged · loading source

@aiscene/aiserver@2.1.2

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code