registry / @antseed/node / 0.2.97

@antseed/node@0.2.97

Broken dependency pin: published against @antseed/api-adapter 0.1.39 while requiring newer streaming adapter exports. Use @antseed/node >=0.2.98.

Antseed Network protocol SDK — P2P inference marketplace

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 122 file(s), 787 KB of source, external domains: 127.0.0.1, base.drpc.org, base.llamarpc.com, base.publicnode.com, github.com, mainnet.base.org, network.antseed.com, raw.githubusercontent.com, sepolia.base.org

Source & flagged code

3 flagged

package.jsonView file

Lines 45-72json

45 "dependencies": {

46 "@silentbot1/nat-api": "^0.4.9",

47 "better-sqlite3": "^12.6.2",

48 "bittorrent-dht": "^11.0.11",

49 "ethers": "~6.16.0",

50 "node-datachannel"

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-ethers.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/config/plugin-loader.jsView file

5export async function loadPluginModule(packageName, pluginsDir) { L6: const { join, resolve } = await import('node:path'); L7: const { pathToFileURL } = await import('node:url');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/plugin-loader.jsView on unpkg · L5

dist/discovery/dht-node.jsView file

213return; L214: if (!this.config.allowPrivateIPs && !isPublicIP(peer.host)) L215: return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/discovery/dht-node.jsView on unpkg · L213

Findings

1 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiredist/config/plugin-loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/discovery/dht-node.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/config/plugin-loader.jsView file

Lines 1-25javascript

1import { getInstances } from './plugin-config-manager.js';

2/**

3 * Load a plugin's default export from its npm package.

4 */

5export async function loadPluginModule(packageName, pluginsDir) {

6 const { join, resolve } = await import('node:path');

7 const { pathToFileURL } = await import('node:url');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/plugin-loader.jsView on unpkg · L5

8 const pluginPath = join(pluginsDir, 'node_modules', packageName, 'dist', 'index.js');

9 const resolved = resolve(pluginPath);

10 if (!resolved.startsWith(resolve(pluginsDir))) {

11 throw new Error(`Invalid plugin path: ${packageName}`);

12 }

13 let mod;

14 try {

15 mod = await import(pathToFileURL(resolved).href);

16 }

17 catch (err) {

18 const cause = err instanceof Error ? err.message : String(err);

19 throw new Error(`Plugin "${packageName}" failed to load from ${resolved}: ${cause}`);

20 }

21 const plugin = mod.default;

22 if (!plugin || typeof plugin !== 'object') {

23 throw new Error(`Plugin "${packageName}" does not export a valid plugin object`);

24 }

25 const typed = plugin;

dist/discovery/dht-node.jsView file

Lines 193-233javascript

193 * listener warning once subnet fan-out exceeds 10 topics.

194 */

195 async lookupMany(infoHashes) {

196 return new Promise((resolve) => {

197 if (!this.dht) {

198 resolve([]);

199 return;

200 }

201 if (infoHashes.length === 0) {

202 resolve([]);

203 return;

204 }

205 const wantedHashes = new Set(infoHashes.map((hash) => hash.toString("hex")));

206 const peers = [];

207 let pending = infoHashes.length;

208 let done = false;

209 const onPeer = (peer, hash) => {

210 if (!wantedHashes.has(hash.toString("hex")))

211 return;

212 if (peer.port < 1 || peer.port > 65535)

213 return;

214 if (!this.config.allowPrivateIPs && !isPublicIP(peer.host))

215 return;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/discovery/dht-node.jsView on unpkg · L213

216 peers.push({ host: peer.host, port: peer.port });

217 };

218 const finish = () => {

219 if (done)

220 return;

221 done = true;

222 clearTimeout(timeout);

223 this.dht?.off("peer", onPeer);

224 resolve(peers);

225 };

226 this.dht.on("peer", onPeer);

227 const timeout = setTimeout(() => {

228 finish();

229 }, this.config.operationTimeoutMs);

230 for (const infoHash of infoHashes) {

231 this.dht.lookup(infoHash, () => {

232 pending -= 1;

233 if (pending === 0)