registry / @cyberrant-rantai/rantai / 1.1.2

@cyberrant-rantai/rantai@1.1.2

RantAI Agent is an AI powered cybersecurity agent that helps users execute real security tasks through intelligent automation and assistance.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.58 KB of source, external domains: www.python.org

Source & flagged code

5 flagged

package.jsonView file

Lines 16-42json

16 "rantai",

17 "cyberrant",

18 "ai",

19 "cybersecurity",

20 "security",

21 "agent",

22 "automation",

23 "cli",

24 "terminal"

25 ],

26 "bin": {

27 "rantai": "./bin/rantaiagent.js"

28 },

29 "files": [

30 "bin/",

31 "lib/",

32 "runtime/",

33 "README.md"

34 ],

35 "scripts": {

36 "postinstall": "node lib/setup.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 },

38 "engines": {

39 "node": ">=18"

40 }

41}

runtime/ai_deep_scan_report.jsonView file

Lines 107-147json

107 "severity": "HIGH",

108 "title": "Malicious-content check runs after mode selection but keyword precedence lets escalation triggers coexist with bypassed red-lines",

109 "detail": "MODE_B_TRIGGERS include generic words like 'admin', 'report', 'logs', 'traffic'. Any prompt containing these auto-elevates to OPERATIONAL mode (line 55-56) even when the actual intent is malicious but phrased to avoid the exact MALICIOUS_PATTERNS strings. Combined with the substring-only red-line check, a crafted prompt can reach state COMPLETED in OPERATIONAL mode while performing a restricted intent, because classification is keyword-driven with no fail-closed default.",

110 "fix"

bin/rantaiagent.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawnSync } = require('child_process');

3const path = require('path');

High

Child Process

Package source references child process execution.

bin/rantaiagent.jsView on unpkg · L1

runtime/database.pyView file

•path = runtime/database.py kind = build_helper sizeBytes = 1402 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/database.pyView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/setup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code