registry / @cocorograph/hub-agent / 0.7.34

@cocorograph/hub-agent@0.7.34

Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの tmux/pty を中継する。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 39 file(s), 807 KB of source, external domains: api.hub.cocorograph.com, hub.cocorograph.com

Source & flagged code

6 flagged

package.jsonView file

Lines 2-42json

2 "name": "@cocorograph/hub-agent",

3 "version": "0.7.34",

4 "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの tmux/pty を中継する。",

5 "type": "module",

6 "license": "UNLICENSED",

7 "private": false,

8 "publishConfig": {

9 "access": "public",

10 "registry": "https://registry.npmjs.org/"

11 },

12 "bin": {

13 "hub-agent": "bin/hub-agent.mjs"

14 },

15 "main": "src/main.mjs",

16 "engines": {

17 "node": ">=20"

18 },

19 "scripts": {

20 "start": "node bin/hub-agent.mjs start",

21 "test": "node --test test/*.test.mjs",

22 "postinstall": "node scripts/fix-node-pty-perms.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

23 "check:publish-on-main": "node scripts/check-publish-on-main.mjs",

24 "prepublishOnly": "node scripts/check-publish-on-main.mjs && npm test"

25 },

26 "files": [

27 "bin/",

28 "src/",

29 "scripts/",

30 "templates/",

31 "plugins/",

32 "README.md",

33 "LICENSE"

34 ],

35 "dependencies": {

36 "@anthropic-ai/claude-agent-sdk": "^0.3.158",

37 "@lydell/node-pty": "1.2.0-beta.12",

38 "commander": "^12.1.0",

39 "pino": "^9.0.0",

40 "ws": "^8.18.0"

41 },

42 "repository": {

src/plugin-loader.mjsView file

Lines 1-40javascript

1/**

2 * `~/.hub/plugins/<prio>-<name>/plugin.mjs` を discovery し、hook chain を構築する。

3 *

4 * - ディレクトリ名の `<prio>` 数字昇順で並ぶ

5 * - 各 plugin の default export が `{ name, hooks }` を持つ

6 * - `runHookChain(name, ctx)` は最初に non-null を返した hook の戻り値を採用

7 *

8 * 仕様書: ナレッジ/インフラ/cockpit-hub-hosted-integration-spec (id=6080)

9 */

10import { promises as fs } from "node:fs"

src/tui-viewer-registry.mjsView file

Lines 6-46javascript

6 * PreToolUse 承認フック (bridge_permission.py) は、ツール実行前にこのマーカーの

7 * 鮮度を読み、「閲覧者がいる session だけ承認を Cockpit へブリッジ、いなければ

8 * 即 ask 縮退」する。これにより、承認フックを全ユーザーの settings.json に常設

9 * しても、非閲覧の対話セッション (リーダー / cockpit-orch サブ / ターミナルモード)

10 * の Bash がブリッジ応答 TTL ぶんハングする地雷を回避する。

src/service-install.mjsView file

Lines 1-24javascript

1/**

2 * `hub-agent install-service` / `uninstall-service` の実装 (Sprint J)。

3 *

4 * - macOS: ~/Library/LaunchAgents/co.cocorograph.hub-agent.plist を install

5 * して launchctl bootstrap gui/<uid> で常駐化

6 * - Linux: ~/.config/systemd/user/hub-agent.service を install して

7 * systemctl --user enable --now hub-agent.service

8 *

9 * テンプレ内の __HUB_AGENT_BIN__ / __HOME__ / __PATH__ を実行時に置換する。

10 * 仕様書: ナレッジ/インフラ/cockpit-hub-hosted-integration-spec (id=6080)

11 */

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 37461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

src/codex-appserver-client.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cocorograph/hub-agent@0.7.42 matchedIdentity = npm:QGNvY29yb2dyYXBoL2h1Yi1hZ2VudA:0.7.42 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codex-appserver-client.mjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty-perms.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/plugin-loader.mjsView file

20* L21: * @returns {Promise<import('./hooks.mjs').Plugin[]>} L22: */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/plugin-loader.mjsView on unpkg · L20

src/tui-viewer-registry.mjsView file

26export const VIEWERS_DIR = L27: process.env.COCKPIT_VIEWERS_DIR || "/tmp/cockpit_tui_viewers" L28: ... L176: try { L177: body = JSON.parse(await readFile(fp, "utf-8")) L178: } catch {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/tui-viewer-registry.mjsView on unpkg · L26

src/service-install.mjsView file

4* - macOS: ~/Library/LaunchAgents/co.cocorograph.hub-agent.plist を install L5: * して launchctl bootstrap gui/<uid> で常駐化 L6: * - Linux: ~/.config/systemd/user/hub-agent.service を install して ... L14: import path from "node:path" L15: import { spawnSync } from "node:child_process" L16: import { fileURLToPath } from "node:url" ... L36: function macPlistPath() { L37: return path.join(os.homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`) L38: } ... L66: // 通常環境への副作用はゼロ。 L67: const nodeExtraCa = process.env.NODE_EXTRA_CA_CERTS || "" L68: let plistEntry = ""

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/service-install.mjsView on unpkg · L4

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 37461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

src/codex-appserver-client.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codex-appserver-client.mjsView on unpkg

Findings

2 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPrevious Version Dangerous Deltasrc/codex-appserver-client.mjs

MediumDynamic Requiresrc/plugin-loader.mjs

MediumEnvironment Vars

MediumInstall Persistencesrc/service-install.mjs

MediumShips Build Helperscripts/install.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/tui-viewer-registry.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

package.jsonView file

Lines 2-42json

2 "name": "@cocorograph/hub-agent",

3 "version": "0.7.34",

4 "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの tmux/pty を中継する。",

5 "type": "module",

6 "license": "UNLICENSED",

7 "private": false,

8 "publishConfig": {

9 "access": "public",

10 "registry": "https://registry.npmjs.org/"

11 },

12 "bin": {

13 "hub-agent": "bin/hub-agent.mjs"

14 },

15 "main": "src/main.mjs",

16 "engines": {

17 "node": ">=20"

18 },

19 "scripts": {

20 "start": "node bin/hub-agent.mjs start",

21 "test": "node --test test/*.test.mjs",

22 "postinstall": "node scripts/fix-node-pty-perms.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

23 "check:publish-on-main": "node scripts/check-publish-on-main.mjs",

24 "prepublishOnly": "node scripts/check-publish-on-main.mjs && npm test"

25 },

26 "files": [

27 "bin/",

28 "src/",

29 "scripts/",

30 "templates/",

31 "plugins/",

32 "README.md",

33 "LICENSE"

34 ],

35 "dependencies": {

36 "@anthropic-ai/claude-agent-sdk": "^0.3.158",

37 "@lydell/node-pty": "1.2.0-beta.12",

38 "commander": "^12.1.0",

39 "pino": "^9.0.0",

40 "ws": "^8.18.0"

41 },

42 "repository": {

src/plugin-loader.mjsView file

Lines 1-40javascript

1/**

2 * `~/.hub/plugins/<prio>-<name>/plugin.mjs` を discovery し、hook chain を構築する。

3 *

4 * - ディレクトリ名の `<prio>` 数字昇順で並ぶ

5 * - 各 plugin の default export が `{ name, hooks }` を持つ

6 * - `runHookChain(name, ctx)` は最初に non-null を返した hook の戻り値を採用

7 *

8 * 仕様書: ナレッジ/インフラ/cockpit-hub-hosted-integration-spec (id=6080)

9 */

10import { promises as fs } from "node:fs"

src/tui-viewer-registry.mjsView file

Lines 6-46javascript

6 * PreToolUse 承認フック (bridge_permission.py) は、ツール実行前にこのマーカーの

7 * 鮮度を読み、「閲覧者がいる session だけ承認を Cockpit へブリッジ、いなければ

8 * 即 ask 縮退」する。これにより、承認フックを全ユーザーの settings.json に常設

9 * しても、非閲覧の対話セッション (リーダー / cockpit-orch サブ / ターミナルモード)

10 * の Bash がブリッジ応答 TTL ぶんハングする地雷を回避する。

src/service-install.mjsView file

Lines 1-24javascript

1/**

2 * `hub-agent install-service` / `uninstall-service` の実装 (Sprint J)。

3 *

4 * - macOS: ~/Library/LaunchAgents/co.cocorograph.hub-agent.plist を install

5 * して launchctl bootstrap gui/<uid> で常駐化

6 * - Linux: ~/.config/systemd/user/hub-agent.service を install して

7 * systemctl --user enable --now hub-agent.service

8 *

9 * テンプレ内の __HUB_AGENT_BIN__ / __HOME__ / __PATH__ を実行時に置換する。

10 * 仕様書: ナレッジ/インフラ/cockpit-hub-hosted-integration-spec (id=6080)

11 */

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 37461 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

src/codex-appserver-client.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/codex-appserver-client.mjsView on unpkg