registry / @bolloon/bolloon-agent / 0.2.8

@bolloon/bolloon-agent@0.2.8

⚠ Under review

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 262 file(s), 2.20 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.xiaomi.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, esm.sh, eth.llamarpc.com, example.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn, openclaw.ai, openrouter.ai, platform.minimaxi.com, registry.npmjs.org, www.google.com, www.volcengine.com

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "scripts": {

21 "build": "npm run build --workspaces --if-present",

22 "build:main": "tsc",

23 "build:cli": "node scripts/build-cli.js",

24 "build:web": "npx tsx scripts/build-web.ts",

25 "build:electron": "tsc -p tsconfig.electron.json",

26 "build:all": "npm run build:main && npm run build:web && npm run build:electron && npm run build:cli",

27 "start": "node dist/index.js",

28 "dev": "tsx -r dotenv/config src/index.ts",

29 "dev:web": "npm run build:web && tsx -r dotenv/config src/index.ts --web",

30 "dev:electron": "npm run build:electron && npm run electron:start",

31 "electron:start": "NODE_ENV=development electron dist/electron.js",

32 "electron:dev": "concurrently \"npm run dev:web\" \"npm run electron:start\"",

33 "electron:build": "npm run build:electron && electron-builder",

34 "electron:pack": "electron-builder --dir",

35 "app:bundle": "node scripts/build-app-bundle.cjs",

36 "app:bundle:open": "node scripts/build-app-bundle.cjs && open \"release/mac-arm64/Bolloon Agent.app\"",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "test:pi-sdk": "tsx src/test/pi-sdk.test.ts",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "workspaces": [

43 "src/constraint-runtime"

44 ],

45 "dependencies": {

46 "@bolloon/bolloon-agent": "^0.1.36",

47 "@bolloon/constraint-runtime": "0.1.0",

48 "@capacitor/core": "^8.4.1",

49 "@capacitor/ios": "^8.4.1",

50 "@chainsafe/libp2p-noise": "^17.0.0",

51 "@chainsafe/libp2p-yamux": "^8.0.1",

52 "@diap/sdk": "^0.1.10",

53 "@libp2p/autonat": "^3.0.20",

54 "@libp2p/circuit-relay-v2": "^4.2.5",

55 "@libp2p/dcutr": "^3.0.20",

56 "@libp2p/identify": "^4.1.6",

57 "@libp2p/kad-dht": "^16.2.6",

58 "@libp2p/tcp": "^11.0.20",

59 "@libp2p/upnp-nat": "^4.0.20",

60 "@multiformats/multiaddr": "^13.0.3",

bin/bolloon.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require("path");

3const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

4const fs = require

dist/heartbeat/StartupVerifier.jsView file

Lines 69-109javascript

69 }

70 // 3. 检查 LLM 配置

71 this.addCheck('llm_config');

72 this.startCheck('llm_config');

73 const hasLlmKey = !!(process.env.OPENAI_API_KEY ||

dist/security/input-scanner.jsView file

Lines 36-76javascript

36 { kind: 'pii-privatekey', re: /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/g },

37 { kind: 'secret-aws', re: /AKIA[0-9A-Z]{16}/g },

38 { kind: 'secret-github',

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

dist/agents/pi-sdk.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bolloon/bolloon-agent@0.2.7 matchedIdentity = npm:QGJvbGxvb24vYm9sbG9vbi1hZ2VudA:0.2.7 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/pi-sdk.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bolloon.cjsView file

1#!/usr/bin/env node L2: const path = require("path"); L3: const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

dist/heartbeat/StartupVerifier.jsView file

89package = @bolloon/bolloon-agent; repositoryIdentity = bolloon; dependency = @diap/sdk L89: try { L90: await import('@diap/sdk'); L91: this.completeCheck('p2p_modules', true, '@diap/sdk available');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/heartbeat/StartupVerifier.jsView on unpkg · L89

dist/security/input-scanner.jsView file

56contains invisible/control Unicode U+200B (zero width space) const WHITESPACE_ANOMALY_RE = /[<U+200B>-<U+200F><U+FEFF>]{5,}/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/input-scanner.jsView on unpkg · L56

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

dist/agents/pi-sdk.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/pi-sdk.jsView on unpkg

Findings

1 Critical4 High7 Medium4 Low

CriticalTrojan Source Unicodedist/security/input-scanner.js

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/heartbeat/StartupVerifier.js

HighShips High Entropy Blobdist/web/icons/favicon.icns

HighPrevious Version Dangerous Deltadist/agents/pi-sdk.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/bolloon.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/ipfs

MediumShips Build Helperbin/bolloon.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "scripts": {

21 "build": "npm run build --workspaces --if-present",

22 "build:main": "tsc",

23 "build:cli": "node scripts/build-cli.js",

24 "build:web": "npx tsx scripts/build-web.ts",

25 "build:electron": "tsc -p tsconfig.electron.json",

26 "build:all": "npm run build:main && npm run build:web && npm run build:electron && npm run build:cli",

27 "start": "node dist/index.js",

28 "dev": "tsx -r dotenv/config src/index.ts",

29 "dev:web": "npm run build:web && tsx -r dotenv/config src/index.ts --web",

30 "dev:electron": "npm run build:electron && npm run electron:start",

31 "electron:start": "NODE_ENV=development electron dist/electron.js",

32 "electron:dev": "concurrently \"npm run dev:web\" \"npm run electron:start\"",

33 "electron:build": "npm run build:electron && electron-builder",

34 "electron:pack": "electron-builder --dir",

35 "app:bundle": "node scripts/build-app-bundle.cjs",

36 "app:bundle:open": "node scripts/build-app-bundle.cjs && open \"release/mac-arm64/Bolloon Agent.app\"",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "test:pi-sdk": "tsx src/test/pi-sdk.test.ts",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "workspaces": [

43 "src/constraint-runtime"

44 ],

45 "dependencies": {

46 "@bolloon/bolloon-agent": "^0.1.36",

47 "@bolloon/constraint-runtime": "0.1.0",

48 "@capacitor/core": "^8.4.1",

49 "@capacitor/ios": "^8.4.1",

50 "@chainsafe/libp2p-noise": "^17.0.0",

51 "@chainsafe/libp2p-yamux": "^8.0.1",

52 "@diap/sdk": "^0.1.10",

53 "@libp2p/autonat": "^3.0.20",

54 "@libp2p/circuit-relay-v2": "^4.2.5",

55 "@libp2p/dcutr": "^3.0.20",

56 "@libp2p/identify": "^4.1.6",

57 "@libp2p/kad-dht": "^16.2.6",

58 "@libp2p/tcp": "^11.0.20",

59 "@libp2p/upnp-nat": "^4.0.20",

60 "@multiformats/multiaddr": "^13.0.3",

bin/bolloon.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require("path");

3const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

4const fs = require

dist/heartbeat/StartupVerifier.jsView file

Lines 69-109javascript

69 }

70 // 3. 检查 LLM 配置

71 this.addCheck('llm_config');

72 this.startCheck('llm_config');

73 const hasLlmKey = !!(process.env.OPENAI_API_KEY ||

dist/security/input-scanner.jsView file

Lines 36-76javascript

36 { kind: 'pii-privatekey', re: /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/g },

37 { kind: 'secret-aws', re: /AKIA[0-9A-Z]{16}/g },

38 { kind: 'secret-github',

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

dist/agents/pi-sdk.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/pi-sdk.jsView on unpkg