registry / @decentnetwork/lan / 0.1.198
@decentnetwork/lan@0.1.198
⚠ Under reviewPrivate virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
CopyleftLicense
Source & flagged code
7 flaggeddist/tun/route-manager.jsView file
4*/
L5: import { execSync } from "child_process";
L6: import { Logger } from "../utils/logger.js";
High
Child Process
Package source references child process execution.
dist/tun/route-manager.jsView on unpkg · L4dist/cli/commands.jsView file
1426// certutil -user -addstore ROOT is rejected on modern Windows
L1427: // (0x80070032 ERROR_NOT_SUPPORTED); PowerShell Import-Certificate into
L1428: // CurrentUser\Root works without admin (Windows pops a confirmation dialog).
High
5Cross-file remote execution chain: dist/cli/commands.js spawns dist/ui/server.js; helper contains network access plus dynamic code execution.
L5: import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs";
L6: import { createConnection } from "net";
L7: import { createRequire } from "module";
...
L88: sock.on("connect", () => {
L89: sock.write(JSON.stringify(req) + "\n");
L90: });
L91: sock.on("data", (chunk) => {
L92: buf += chunk.toString("utf-8");
L93: const nl = buf.indexOf("\n");
...
L141: // surface a hint if it doesn't go through. Skipped for any dora the
L142: // user removed from dora.userids (i.e. they're pointing at a private
L143: // set — they'll run `agentnet dora enable` themselves). The defaults
Findings
1 Critical3 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/daemon/server.js
HighChild Processdist/tun/route-manager.js
HighShelldist/cli/commands.js
HighCross File Remote Execution Contextdist/cli/commands.js
MediumDynamic Requiredist/ui/desktop/vendor/react-dom.production.min.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/commands.js
MediumShips Native Binarybin/tun-helper-linux-arm64
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Low
Affected versions and remediation
This report applies to @decentnetwork/lan@0.1.198.
See all versions of @decentnetwork/lan for other recorded verdicts.
- Review the evidence and your use of @decentnetwork/lan@0.1.198 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.