registry / @arcforge/axon / 2.0.47

@arcforge/axon@2.0.47

coding agent cli

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVars

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 7 file(s), 283 KB of source, external domains: axon.arclabs.it

Oversized source lightweight scan

app.js21.8 MB file, sampled 256 KB

ChildProcessDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsProtestwareaxon.arclabs.it

Source & flagged code

5 flagged

capsule-process.jsView file

Lines 1-8javascript

1#!/usr/bin/env bun

2// @bun

3import{AsyncLocalStorage as ZJ}from"async_hooks";var f=["log","info","warn","error","debug"];function v(J){let{wire:G}=J,$=new ZJ,z={log:console.log.bind(console),info:console.info.bind(console),warn:console.warn.bind(console),error:console.error.bind(console),debug:console.debug.bind(console)};for(let N of f)console[N]=(...H)=>{let X=$.getStore()??null;G.emit("capsule:console",{level:N,commandId:X,args:H})};return{run(N,H){return $.run(N,H)},write(N,H){let X=$.getStore()??null,Y=typeof H==="string"?H:new TextDecoder().decode(H);return G.emit("capsule:console",{level:N,commandId:X,args:[Y]}),! ...

4`),matches:[],totalLines:H,matchedLines:X.length};function _(Z){if(Q&&Q.test(Z))return!1;if(Y&&!Y.test(Z))return!1;if(F&&!F.test(Z))return!1;return!0}let K=z.context??0,T=[],B=new Set;for(let Z=0;Z<X.length;Z++){let P=X[Z];if(P===void 0||!_(P))continue;B.add(Z),T.push({line:Z,text:P,before:K>0?X.slice(Math.max(0,Z-K),Z):[],after:K>0?X.slice(Z+1,Math.min(X.length,Z+1+K)):[]})}let D=X.filter((Z,P)=>B.has(P));return{procId:J,stream:$,lines:D,raw:D.join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capsule-process.jsView on unpkg · L2

5`),matches:T,totalLines:H,matchedLines:D.length}}function i(J){if(J instanceof RegExp)return($)=>J.test($);let G=J.toLowerCase();return($)=>$.toLowerCase().includes(G)}function PJ(J,G){if(!J)return"";let $=[],z=0;for(let N=0;N<J.length;N++)if(J[N]===`

6`)$.push(J.slice(z,N+1)),z=N+1;if(z<J.length)$.push(J.slice(z));return $.slice(-G).join("")}function s(J,G){let $=new Promise((H)=>{if(J.status==="exited"){H({exitCode:J.exitCode??-1,ok:J.exitCode===0,stdout:J.stdout.join("")});return}let X=G.subscribe(J.procId+":exit",()=>{X(),H({exitCode:J.exitCode??-1,ok:J.exitCode===0,stdout:J.stdout.join("")})})});function z(H=["stdout"]){let X=[];if(H.includes("stdout"))X.push(J.stdout.join(""));if(H.includes("stderr"))X.push(J.stderr.join(""));return X.join("")}let N={get procId(){return J.procId},get kind(){return J.kind},get command(){return J.command ...

7`)},onCommand(z){return J.add(z),()=>J.delete(z)}}}var r=process.exit.bind(process);function t(J){let G=process;if(

Long lines were clipped for display.

update-helper.jsView file

Lines 1-13javascript

1// @bun

2import{mkdir as X,rename as Y,writeFile as Z}from"fs/promises";import{dirname as $}from"path";var V=4;async function

app.jsView file

•path = app.js kind = oversized_source_file sizeBytes = 22847371 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

app.jsView on unpkg

•path = app.js kind = oversized_cli_entrypoint sizeBytes = 22847371 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

app.jsView on unpkg

Source & flagged code

5 flagged · loading source

capsule-process.jsView file

2// @bun L3: import{AsyncLocalStorage as ZJ}from"async_hooks";var f=["log","info","warn","error","debug"];function v(J){let{wire:G}=J,$=new ZJ,z={log:console.log.bind(console),info:console.info... L4: `),matches:[],totalLines:H,matchedLines:X.length};function _(Z){if(Q&&Q.test(Z))return!1;if(Y&&!Y.test(Z))return!1;if(F&&!F.test(Z))return!1;return!0}let K=z.context??0,T=[],B=new ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capsule-process.jsView on unpkg · L2

update-helper.jsView file

1// @bun L2: import{mkdir as X,rename as Y,writeFile as Z}from"fs/promises";import{dirname as $}from"path";var V=4;async function w(j,q={}){let z=q.run??F,D=q.sleep??Bun.sleep;await R(j.state,{... L3: Updating Axon ${j.from} \u2192 ${j.to}\u2026 ... L7: `),0}process.stderr.write(`Axon update failed verification; restoring the previous version\u2026 L8: `);let B=await z([j.bun,"add","-g",`@arcforge/axon@${j.from}`]),O=B.code===0?`update to ${j.to} failed verification; restored ${j.from}`:`update to ${j.to} failed and rollback to $... L9: L10: `),1}function C(j){let q=new Map;for(let K=0;K<j.length;K+=2){let G=j[K],Q=j[K+1];if(!G?.startsWith("--")||Q===void 0)throw Error("UPDATE_HELPER_ARGS_INVALID");q.set(G.slice(2),Q)}... L11: `,"utf-8"),await Y(z,j)}function W(j){return/^\d+\.\d+\.\d+

High

Sandbox Evasion Gated Capability

Findings

3 High5 Medium4 Low

HighSandbox Evasion Gated Capabilityupdate-helper.js

HighOversized Source Fileapp.js

HighPrevious Version Dangerous Deltaupdate-helper.js

MediumDynamic Requirecapsule-process.js

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointapp.js

MediumStructural Risk Force Deep Review

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License