6// remote/server.mjs
L7: import { createServer } from "node:http";
L8: import { createServer as createHttpsServer } from "node:https";
...
L24: import { fileURLToPath, pathToFileURL } from "node:url";
L25: import { spawn as spawn2 } from "node:child_process";
L26:
...
L244: tCount += count;
L245: shardStats.push({ index: meta.index, jobId: meta.jobId, state: meta.state, exitCode: meta.exitCode, pass, fail, skip, hasReport: Boolean(hasReport), attempt: attemptCount(meta), re...
L246: }
...
L383: import { spawn } from "node:child_process";
L384: var ROOT_JSON_DENY = /* @__PURE__ */ new Set(["package.json", "package-lock.json"]);
L385: async function packPayload(repoRoot, log = () => {
CriticalCommand Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
grid.mjsView on unpkg · L6 6Trigger-reachable chain: manifest.bin -> bin.mjs -> grid.mjs
L6: // remote/server.mjs
L7: import { createServer } from "node:http";
L8: import { createServer as createHttpsServer } from "node:https";
...
L24: import { fileURLToPath, pathToFileURL } from "node:url";
L25: import { spawn as spawn2 } from "node:child_process";
L26:
...
L244: tCount += count;
L245: shardStats.push({ index: meta.index, jobId: meta.jobId, state: meta.state, exitCode: meta.exitCode, pass, fail, skip, hasReport: Boolean(hasReport), attempt: attemptCount(meta), re...
L246: }
...
L383: import { spawn } from "node:child_process";
L384: var ROOT_JSON_DENY = /* @__PURE__ */ new Set(["package.json", "package-lock.json"]);
L385: async function packPayload(repoRoot, log = () => {
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
grid.mjsView on unpkg · L6 •matchType = previous_version_dangerous_delta
matchedPackage = @avi892nash/aegis-grid-runner@0.2.0
matchedIdentity = npm:[redacted]:0.2.0
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
CriticalPrevious Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
grid.mjsView on unpkg 24import { fileURLToPath, pathToFileURL } from "node:url";
L25: import { spawn as spawn2 } from "node:child_process";
L26:
6675}
L6676: var RUNNER_PORT_BASE = Math.max(1, Number(process.env.GRID_RUNNER_PORT ?? 7719));
L6677: var RUNNER_PORT_SCAN = 20;
...
L6683: var masterHdrs = () => ({ "content-type": "application/json", ...masterToken ? { "x-grid-token": masterToken } : {} });
L6684: var api = (p, init = {}) => fetch(`${masterUrl}${p}`, { ...init, headers: { ...masterHdrs(), ...init.headers ?? {} } });
L6685: var sh = (cmd2, args) => {
L6686: try {
L6687: return execFileSync(cmd2, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
L6688: } catch {
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
grid.mjsView on unpkg · L6675 6// remote/server.mjs
L7: import { createServer } from "node:http";
L8: import { createServer as createHttpsServer } from "node:https";
...
L24: import { fileURLToPath, pathToFileURL } from "node:url";
L25: import { spawn as spawn2 } from "node:child_process";
L26:
...
L244: tCount += count;
L245: shardStats.push({ index: meta.index, jobId: meta.jobId, state: meta.state, exitCode: meta.exitCode, pass, fail, skip, hasReport: Boolean(hasReport), attempt: attemptCount(meta), re...
L246: }
...
L383: import { spawn } from "node:child_process";
L384: var ROOT_JSON_DENY = /* @__PURE__ */ new Set(["package.json", "package-lock.json"]);
L385: async function packPayload(repoRoot, log = () => {
LowWeak Crypto
Package source references weak cryptographic algorithms.
grid.mjsView on unpkg · L6