registry / @artsum/agenthub / 1.0.4

@artsum/agenthub@1.0.4

Mobile and Web client for Claude Code and Codex

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 1.37 MB of source, external domains: 127.0.0.1, agenthub.yzsd.asia, api.openai.com, auth.openai.com, claude.ai, console.anthropic.com, github.com, registry.npmjs.org, www.apple.com

Source & flagged code

9 flagged

package.jsonView file

Lines 113-135json

113 "eslint": "^9",

114 "eslint-config-prettier": "^10",

115 "pkgroll": "^2.14.2",

116 "shx": "^0.3.3",

117 "ts-node": "^10",

118 "tsx": "^4.20.6",

119 "typescript": "5.9.3",

120 "vitest": "^3.2.6"

121 },

122 "publishConfig": {

123 "registry": "https://registry.npmjs.org/",

124 "access": "public"

125 },

126 "scripts": {

127 "typecheck": "tsc --noEmit",

128 "build": "shx rm -rf dist && tsc --noEmit && pkgroll",

129 "test": "pnpm run build && vitest run",

130 "test:unit": "pnpm run build && vitest run --project unit",

131 "test:integration": "vitest run --project integration-empty --project integration-plan-mode --project integration-authenticated",

132 "cli:install": "node scripts/install-local.cjs",

133 "postinstall": "node scripts/unpack-tools.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L133

134 }

135}

bin/agenthub.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { createRequire } from 'module';

High

Child Process

Package source references child process execution.

bin/agenthub.mjsView on unpkg · L2

5import { fileURLToPath } from

dist/index.cjsView file

Lines 1-35javascript

1'use strict';

3var chalk = require('chalk');

4var os = require('node:os');

5var node_crypto = require(

scripts/download-tools.shView file

•path = scripts/download-tools.sh kind = build_helper sizeBytes = 4241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/download-tools.shView on unpkg

tools/archives/difftastic-arm64-linux.tar.gzView file

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = high_entropy_blob sizeBytes = 11425536 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

•path = tools/archives/difftastic-arm64-linux.tar.gz kind = compressed_blob sizeBytes = 11425536 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

tools/archives/difftastic-arm64-linux.tar.gzView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code