registry / @asterworks/agent-console / 0.1.7

@asterworks/agent-console@0.1.7

Local-first AI coding agent safety, work audit, and outcome dashboard for Claude Code and Codex.

Static Scan Results

scanned 12h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 858 KB of source, external domains: api.example.com, fb.me, reactjs.org, www.apple.com, www.w3.org

Source & flagged code

5 flagged

dist-cli/index.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

5 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

6};

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/cli/util/browser.ts

13var browser_exports = {};

14__export(browser_exports, {

15 openBrowser: () => openBrowser

16});

17import { spawn } from "child_process";

18function openBrowser(url) {

19 try {

20 const platform = process.platform;

21 const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-cli/index.jsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-cli/index.jsView on unpkg · L16

22 const args = platform === "win32" ? ["/c", "start", "", url] : [url];

23 const child = spawn(cmd, args, { stdio: "ignore", detached: true });

24 child.on("error", () => {

25 });

26 child.unref();

27 } catch {

28 }

29}

30var init_browser = __esm({

31 "src/cli/util/browser.ts"() {

32 "use strict";

33 }

34});

36// src/cli/index.ts

Lines 549-589javascript

549 // Generic OpenAI keys incl. newer sk-proj-/sk-svcacct- formats (allow - and _).

550 { kind: "api_key", re: /\bsk-[A-Za-z0-9][A-Za-z0-9_-]{18,}\b/g, keepTail: 4 },

551 { kind: "github_token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b

•matchType = previous_version_dangerous_delta matchedPackage = @asterworks/agent-console@0.1.5 matchedIdentity = npm:[redacted]:0.1.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-cli/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist-cli/index.jsView file

569patternName = private_key_rsa severity = critical line = 569 matchedText = if (kind...d]";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist-cli/index.jsView on unpkg · L569

569patternName = private_key_rsa severity = critical line = 569 matchedText = if (kind...d]";

Critical

Secret Pattern

RSA private key in dist-cli/index.js

dist-cli/index.jsView on unpkg · L569

16Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L16: }); L17: import { spawn } from "child_process"; L18: function openBrowser(url) { L19: try { L20: const platform = process.platform; L21: const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open"; ... L56: import { homedir } from "os"; L57: var DEFAULT_CONFIG_DIR = join(homedir(), ".aster-agent-console"); L58: var DEFAULT_DB_PATH = join(DEFAULT_CONFIG_DIR, "agent-console.db"); ... L318: try { L319: m = JSON.parse(row.metrics_json); L320: } catch {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-cli/index.jsView on unpkg · L16

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-cli/index.jsView on unpkg

16}); L17: import { spawn } from "child_process"; L18: function openBrowser(url) { L19: try { L20: const platform = process.platform; L21: const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open"; ... L56: import { homedir } from "os"; L57: var DEFAULT_CONFIG_DIR = join(homedir(), ".aster-agent-console"); L58: var DEFAULT_DB_PATH = join(DEFAULT_CONFIG_DIR, "agent-console.db"); ... L318: try { L319: m = JSON.parse(row.metrics_json); L320: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-cli/index.jsView on unpkg · L16

Findings

2 Critical2 High5 Medium5 Low

CriticalCritical Secretdist-cli/index.js

CriticalSecret Patterndist-cli/index.js

HighEntrypoint Build Divergencedist-cli/index.js

HighPrevious Version Dangerous Deltadist-cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist-cli/index.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

5 flagged

dist-cli/index.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

5 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

6};

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

12// src/cli/util/browser.ts

13var browser_exports = {};

14__export(browser_exports, {

15 openBrowser: () => openBrowser

16});

17import { spawn } from "child_process";

18function openBrowser(url) {

19 try {

20 const platform = process.platform;

21 const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-cli/index.jsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-cli/index.jsView on unpkg · L16

22 const args = platform === "win32" ? ["/c", "start", "", url] : [url];

23 const child = spawn(cmd, args, { stdio: "ignore", detached: true });

24 child.on("error", () => {

25 });

26 child.unref();

27 } catch {

28 }

29}

30var init_browser = __esm({

31 "src/cli/util/browser.ts"() {

32 "use strict";

33 }

34});

36// src/cli/index.ts

Lines 549-589javascript

549 // Generic OpenAI keys incl. newer sk-proj-/sk-svcacct- formats (allow - and _).

550 { kind: "api_key", re: /\bsk-[A-Za-z0-9][A-Za-z0-9_-]{18,}\b/g, keepTail: 4 },

551 { kind: "github_token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-cli/index.jsView on unpkg