registry / @anthonyhaussman/opencode-agy-auth / 1.2.13

@anthonyhaussman/opencode-agy-auth@1.2.13

[![npm version](https://img.shields.io/npm/v/@anthonyhaussman/opencode-agy-auth)](https://www.npmjs.com/package/@anthonyhaussman/opencode-agy-auth) [![npm downloads](https://img.shields.io/npm/dw/@anthonyhaussman/opencode-agy-auth)](https://www.npmjs.com/

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 819 KB of source, external domains: accounts.google.com, antigravity.google, cloudcode-pa.googleapis.com, daily-cloudcode-pa.googleapis.com, generativelanguage.googleapis.com, goo.gle, json-schema.org, models.dev, oauth2.googleapis.com, www.googleapis.com

Source & flagged code

2 flagged

dist/index.jsView file

133// src/plugin/oauth-authorize.ts L134: import { spawn } from "child_process"; L135:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L133

118var AGY_CODE_ASSIST_ENDPOINT = process.env.OPENCODE_AGY_ENDPOINT || "https://daily-cloudcode-pa.googleapis.com"; L119: var AGY_GENERATIVE_LANGUAGE_ENDPOINT = "https://generativelanguage.googleapis.com/v1beta"; L120: ... L122: function agyFetch(input, init) { L123: const proxy = process.env.OPENCODE_AGY_AUTH_PROXY; L124: if (!proxy) { ... L133: // src/plugin/oauth-authorize.ts L134: import { spawn } from "child_process"; L135:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L118

Findings

2 High2 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @anthonyhaussman/opencode-agy-auth@1.2.13.

See all versions of @anthonyhaussman/opencode-agy-auth for other recorded verdicts.

Review the evidence and your use of @anthonyhaussman/opencode-agy-auth@1.2.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 05:35:59.803Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @anthonyhaussman/opencode-agy-auth / 1.2.13

@anthonyhaussman/opencode-agy-auth@1.2.13

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

2 flagged

dist/index.jsView file

133// src/plugin/oauth-authorize.ts L134: import { spawn } from "child_process"; L135:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L133

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L118

Findings

2 High2 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @anthonyhaussman/opencode-agy-auth@1.2.13.

See all versions of @anthonyhaussman/opencode-agy-auth for other recorded verdicts.

Review the evidence and your use of @anthonyhaussman/opencode-agy-auth@1.2.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 05:35:59.803Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.