registry / @avi892nash/aegis-grid-runner / 0.7.3

@avi892nash/aegis-grid-runner@0.7.3

⚠ Under review

Superseded — upgrade to >=0.7.13. Older versions leak xcodebuild/simulator processes on the host and predate the GRID_TOKEN hardening guidance.

Aegis WDIO device grid — runner (default), master, and CLI in one zero-dependency Node bundle.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 2 file(s), 597 KB of source, external domains: 127.0.0.1, 192.168.0.146, googlechromelabs.github.io, product-details.mozilla.org

Source & flagged code

5 flagged

grid.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @avi892nash/aegis-grid-runner@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

grid.mjsView on unpkg

24import { fileURLToPath, pathToFileURL } from "node:url"; L25: import { spawn as spawn2 } from "node:child_process"; L26:

High

Child Process

Package source references child process execution.

grid.mjsView on unpkg · L24

6894} L6895: var RUNNER_PORT_BASE = Math.max(1, Number(process.env.GRID_RUNNER_PORT ?? 7719)); L6896: var RUNNER_PORT_SCAN = 20; ... L6902: var masterHdrs = () => ({ "content-type": "application/json", ...masterToken ? { "x-grid-token": masterToken } : {} }); L6903: var api = (p, init = {}) => fetch(`${masterUrl}${p}`, { ...init, headers: { ...masterHdrs(), ...init.headers ?? {} } }); L6904: var sh = (cmd2, args) => { L6905: try { L6906: return execFileSync(cmd2, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }); L6907: } catch {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

grid.mjsView on unpkg · L6894

6// remote/server.mjs L7: import { createServer } from "node:http"; L8: import { createServer as createHttpsServer } from "node:https"; ... L24: import { fileURLToPath, pathToFileURL } from "node:url"; L25: import { spawn as spawn2 } from "node:child_process"; L26: ... L244: tCount += count; L245: shardStats.push({ index: meta.index, jobId: meta.jobId, state: meta.state, exitCode: meta.exitCode, pass, fail, skip, hasReport: Boolean(hasReport), attempt: attemptCount(meta), re... L246: } ... L383: import { spawn } from "node:child_process"; L384: var ROOT_JSON_DENY = /* @__PURE__ */ new Set(["package.json", "package-lock.json"]); L385: async function packPayload(repoRoot, log = () => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

grid.mjsView on unpkg · L6

Low

Weak Crypto

Package source references weak cryptographic algorithms.

grid.mjsView on unpkg · L6

Source & flagged code

5 flagged · loading source

grid.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code