registry / @avi892nash/aegis-grid-runner / 0.5.2

@avi892nash/aegis-grid-runner@0.5.2

⚠ Under review

Superseded — upgrade to >=0.7.13. Older versions leak xcodebuild/simulator processes on the host and predate the GRID_TOKEN hardening guidance.

Aegis WDIO device grid — runner (default), master, and CLI in one zero-dependency Node bundle.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 491 KB of source, external domains: 127.0.0.1, 192.168.0.146, googlechromelabs.github.io

Source & flagged code

6 flagged

grid.mjsView file

Lines 1-44javascript

1#!/usr/bin/env node

3// <define:__GRID_BUILD__>

4var define_GRID_BUILD_default = { version: "1.0.0", gitSha: "c907e796", builtAt: "2026-08-06T10:21:18.894Z" };

6// remote/server.mjs

7import { createServer } from "node:http";

8import { createServer as createHttpsServer } from "node:https";

9import { randomUUID, createHash } from "node:crypto";

10import {

11 mkdirSync as mkdirSync2,

12 createWriteStream,

13 createReadStream,

14 existsSync as existsSync2,

15 writeFileSync as writeFileSync2,

16 readFileSync as readFileSync2,

17 readdirSync as readdirSync2,

18 statSync as statSync2,

19 renameSync,

20 rmSync

21} from "node:fs";

22import { cpSync } from "node:fs";

23import { resolve as resolve2, dirname as dirname2, basename as basename2, join as join2, sep } from "node:path";

24import { fileURLToPath, pathToFileURL } from "node:url";

25import { spawn } from "node:child_process";

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

grid.mjsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

grid.mjsView on unpkg · L6

Low

Weak Crypto

Package source references weak cryptographic algorithms.

grid.mjsView on unpkg · L6

High

Child Process

Package source references child process execution.

grid.mjsView on unpkg · L24

27// remote/mergeRun.mjs

28import {

29 existsSync,

30 mkdirSync,

31 readdirSync,

32 readFileSync,

33 writeFileSync,

34 copyFileSync,

35 statSync

36} from "node:fs";

37import { resolve, join, dirname, extname, basename } from "node:path";

38var escHtml = (s) => String(s).replace(/[&<>"]/g, (c) => ({ "&": "&", "<": "<", ">": ">", '"'

39var escCsv = (s) => {

40 const t = String(s);

41 return /[",\n]/.test(t) ? '"' + t.replace(/"/g, '""') + '"' : t;

42};

43function parseCsvLine(line) {

44 const out = [];

Lines 5772-5812javascript

5772 // last provisioning failure (retried next pass)

5773};

5774var RUNNER_ID = process.env.GRID_RUNNER_ID ?? `${hostname()}-${process.pid}`;

5775var RUNNER_ID_FILE =

•matchType = previous_version_dangerous_delta matchedPackage = @avi892nash/aegis-grid-runner@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

grid.mjsView on unpkg

Source & flagged code

6 flagged · loading source

grid.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code