registry / @aseity/lyra / 0.6.0

@aseity/lyra@0.6.0

⚠ Under review

Lyra agent library

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 1.52 MB of source, external domains: 192.168.8.88, ai-chat.hep.com.cn, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, dashscope.aliyuncs.com, json-schema.org, open.bigmodel.cn, openrouter.ai, storage.googleapis.com

Source & flagged code

7 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aseity/lyra@0.4.0 matchedIdentity = npm:QGFzZWl0eS9seXJh:0.4.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

1683`)} L1684: `}function ff(e,t=!1){return e.length<=Tl&&!t?e:e.length<=Tl?e+yA:e.slice(0,Tl)+yA}function xt(e,t){if(typeof e!="function")throw new d(`DeepSeek Harness filesystem sandbox session... L1685:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1683

1848${r}${o} L1849: `}function TB(e){let t=e.split(/\r?\n/);if(t[0]?.trim()!=="---")return{};let n=t.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of t.slice(1,n)){let ... L1850: `).replace(/\r/gu,` ... L1854: `),numLines:u.length,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:l}=Pf(t,e.headLimit,e.offset),u=a.ma... L1855: `),numMatches:c,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}let{items:r,appliedLimit:i}=Pf(t,e.headLimit,e.offset),s=r.map(n);return{mode:o,nu... L1856: import pty

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1848

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1848

1/*! Author: Ty <ty29022@gmail.com> */ L2: var z_=Object.defineProperty;var y=(e,t)=>()=>(e&&(t=e(e=0)),t);var K_=(e,t)=>{for(var n in t)z_(e,n,{get:t[n],enumerable:!0})};var Ie,d,Nn,Qr,ei,Un,an,Nt,Ut,Ro,_o,Co,ti,D,js,ni,E=... L3: `)),n.length>0?n.join(` ... L14: `)}}function Gn(e,t,n){if(n.length===0)return;let o=e[e.length-1];if(o?.role===t){o.content.push(...n);return}e.push({role:t,content:[...n]})}function bM(e,t,n){return typeof e=="s... L15: `):e.type==="text"?e.text:JSON.stringify(e)}function zM(e){return typeof e=="string"?e:Array.isArray(e)?e.map(t=>t.type==="input_text"?{type:"text",text:t.text}:t.type==="input_ima... L16: `),imageContent:o}}if(dn(e)&&e.type==="text"&&typeof e.text=="string")return{toolContent:e.text,imageContent:[]};if(dn(e)&&e.type==="image"){let n=Ak(e),o=

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/index.cjsView file

1848Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1848: ${r}${o} L1849: `}function X$(e){let t=e.split(/\r?\n/);if(t[0]?.trim()!=="---")return{};let n=t.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of t.slice(1,n)){let ... L1850: `).replace(/\r/gu,` ... L1854: `),numLines:u.length,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:l}=og(t,e.headLimit,e.offset),u=a.ma... L1855: `),numMatches:c,...l!==void 0?{appliedLimit:l}:{},...(e.offset??0)>0?{appliedOffset:e.offset}:{}}}let{items:r,appliedLimit:i}=og(t,e.headLimit,e.offset),s=r.map(n);return{mode:o,nu... L1856: import pty

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1848

dist/index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @aseity/lyra@0.11.4 matchedPath = dist/index.d.ts matchedIdentity = npm:QGFzZWl0eS9seXJh:0.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.d.tsView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.jsView file

@aseity/lyra@0.6.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code