registry / @decentnetwork/lan / 0.1.204

@decentnetwork/lan@0.1.204

⚠ Under review

Private virtual LAN for self-hosted services and AI agents, built on Elastos Carrier. NAT-traversal, name service, ACL, all over a peer-to-peer mesh — no public IP required.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

CopyleftLicense

scanned 55 file(s), 1.16 MB of source, external domains: io.beagle.chat, pushapi.beagle.chat, reactjs.org, tokyo.fi.chat, www.apple.com, www.callpass.cn, www.w3.org

Source & flagged code

7 flagged

dist/tun/route-manager.jsView file

Lines 1-25javascript

1/**

2 * TUN device + route management.

3 * Linux uses `ip` (iproute2), macOS uses `ifconfig` + `route`, and

4 * Windows uses the built-in NetTCPIP PowerShell cmdlets.

5 */

High

Shell

Package source references shell execution.

dist/tun/route-manager.jsView on unpkg · L3

6import { execSync } from "child_process";

7import

Source & flagged code

7 flagged · loading source

dist/tun/route-manager.jsView file

5*/ L6: import { execSync } from "child_process"; L7: import { Logger } from "../utils/logger.js";

High

Child Process

Package source references child process execution.

dist/tun/route-manager.jsView on unpkg · L5

3* Linux uses `ip` (iproute2), macOS uses `ifconfig` + `route`, and L4: * Windows uses the built-in NetTCPIP PowerShell cmdlets. L5: */

High

Shell

Package source references shell execution.

dist/tun/route-manager.jsView on unpkg · L3

dist/ui/desktop/vendor/react-dom.production.min.jsView file

12*/ L13: 'use strict';(function(Q,zb){"object"===typeof exports&&"undefined"!==typeof module?zb(exports,require("react")):"function"===typeof define&&define.amd?define(["exports","react"],z... L14: function mb(a,b){Ab(a,b);Ab(a+"Capture",b)}function Ab(a,b){$b[a]=b;for(a=0;a<b.length;a++)cg.add(b[a])}function bj(a){if(Zd.call(dg,a))return!0;if(Zd.call(eg,a))return!1;if(cj.tes...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/desktop/vendor/react-dom.production.min.jsView on unpkg · L12

dist/cli/commands.jsView file

5Cross-file remote execution chain: dist/cli/commands.js spawns dist/ui/server.js; helper contains network access plus dynamic code execution. L5: import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs"; L6: import { createConnection } from "net"; L7: import { createRequire } from "module"; ... L90: sock.on("connect", () => { L91: sock.write(JSON.stringify(req) + "\n"); L92: }); L93: sock.on("data", (chunk) => { L94: buf += chunk.toString("utf-8"); L95: const nl = buf.indexOf("\n"); ... L143: // surface a hint if it doesn't go through. Skipped for any dora the L144: // user removed from dora.userids (i.e. they're pointing at a private L145: // set — they'll run `agentnet dora enable` themselves). The defaults

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/commands.jsView on unpkg · L5

5import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs"; L6: import { createConnection } from "net"; L7: import { createRequire } from "module"; ... L90: sock.on("connect", () => { L91: sock.write(JSON.stringify(req) + "\n"); L92: }); L93: sock.on("data", (chunk) => { L94: buf += chunk.toString("utf-8"); L95: const nl = buf.indexOf("\n"); ... L143: // surface a hint if it doesn't go through. Skipped for any dora the L144: // user removed from dora.userids (i.e. they're pointing at a private L145: // set — they'll run `agentnet dora enable` themselves). The defaults

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands.jsView on unpkg · L5

bin/tun-helper-linux-arm64View file

•path = bin/tun-helper-linux-arm64 kind = native_binary sizeBytes = 2194883 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/tun-helper-linux-arm64View on unpkg

dist/daemon/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @decentnetwork/lan@0.1.137 matchedIdentity = npm:QGRlY2VudG5ldHdvcmsvbGFu:0.1.137 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon/server.jsView on unpkg

Findings

1 Critical3 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/daemon/server.js

HighChild Processdist/tun/route-manager.js

HighShelldist/tun/route-manager.js

HighCross File Remote Execution Contextdist/cli/commands.js

MediumDynamic Requiredist/ui/desktop/vendor/react-dom.production.min.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/commands.js

MediumShips Native Binarybin/tun-helper-linux-arm64

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

dist/ui/desktop/vendor/react-dom.production.min.jsView file

Lines 1-32javascript

1/**

2 * @license React

3 * react-dom.production.min.js

4 *

5 * Copyright (c) Facebook, Inc. and its affiliates.

6 *

7 * This source code is licensed under the MIT license found in the

8 * LICENSE file in the root directory of this source tree.

9 */

10(function(){/*

11 Modernizr 3.0.0pre (Custom Build) | MIT

12*/

13'use strict';(function(Q,zb){"object"===typeof exports&&"undefined"!==typeof module?zb(exports,require("react")):"function"===typeof define&&define.amd?define(["exports","react"],zb):(Q=Q||self,zb(Q.ReactDOM

14function mb(a,b){Ab(a,b);Ab(a+"Capture",b)}function Ab(a,b){$b[a]=b;for(a=0;a<b.length;a++)cg.add(b[a])}function bj(a){if(Zd.call(dg,a))return!0;

15b||"undefined"===typeof b||dj(a,b,c,d))return!0;if(d)return!1;if(null!==c)switch(c.type){case 3:return!b;case 4:return!1===b;case 5:return isNaN(b);case 6:return

16b[0]&&"O"!==b[0]||"n"!==b[1]&&"N"!==b[1])ej(b,c,e,d)&&(c=null),d||null===e?bj(b)&&(null===c?a.removeAttribute(b):a.setAttribute(b,""+c))

17c){if(void 0===ae)try{throw Error();}catch(d){ae=(b=d.stack.trim().match(/\n( *(at )?)/))&&b[1]||""}return"\n"+ae+a}function be(

18}catch(n){d=n}a()}}catch(n){if(n&&d&&"string"===typeof n.stack){for(var e=n.stack.split("\n"),f=d.stack.split("\n"),g=e.length-1,h=f.length-1;1<=

19""}function fj(a){switch(a.tag){case 5:return bc(a.type);case 16:return bc("Lazy");case 13:return bc("Suspense");case 19:return bc("SuspenseList");case 0

20case ge:return"Suspense";case he:return"SuspenseList"}if("object"===typeof a)switch(a.$$typeof){case gg:return(a.displayName||"Context")+".Consumer";case hg:return(a._context.displayName||"Context")+".Provider";case ie:var b=a.render;a=a.displayName;a||(a=b.displayName

21switch(a.tag){case 24:return"Cache";case 9:return(b.displayName||"Context")+".Consumer";case 10:return(b._context.displayName||"Context")+".Provider";case 18:return"DehydratedFragment";case 11:return a=b.render,a=a.displayName

22case 21:return"Scope";case 13:return"Suspense";case 19:return"SuspenseList";case 25:return"TracingMarker";case 1:case 0:case 17:case 2:case 14:case 15

23b)}function hj(a){var b=ig(a)?"checked":"value",c=Object.getOwnPropertyDescriptor(a.constructor.prototype,b),d=""+a[b];if(!a.hasOwnProperty(b)&&"undefined"!==typeof c&&"function"===typeof c.get&&"function"===typeof c.set){var e=

24null;delete a[b]}}}}function Pc(a){a._valueTracker||(a._valueTracker=hj(a))}function jg(a){if(!a)return!1;var b=a._valueTracker;if(!b)return!0;var c=b.getValue();var d="";a&&

25value:void 0,checked:null!=c?c:a._wrapperState.initialChecked})}function kg(a,b){var c=null==b.defaultValue?"":b.defaultValue,d=null!=b.checked?b.checked:b.defaultChecked;c=Ua(null!=b.value?b.value:c);a._wrapperState={initialChecked:d,initialValue:c,controlled:

26c)a.value=""+c}else a.value!==""+c&&(a.value=""+c);else if("submit"===d||"reset"===d){a.removeAttribute("value");return}b.hasOwnProperty("value")?me(a,b.type,c):b.hasOwnProperty("defaultValue")&&me(a,b.type,

27c||b===a.value||(a.value=b);a.defaultValue=b}c=a.name;""!==c&&(a.name="");a.defaultChecked=!!a._wrapperState.initialChecked;""!==c&&(a.name=c)}function me(a,b,c){if("number"!==b||Qc(a.ownerDocument)!==a)

28!0)}else{c=""+Ua(c);b=null;for(e=0;e<a.length;e++){if(a[e].value===c){a[e].selected=!0;d&&(a[e].defaultSelected=!0);return}null!==b||a[e].disabled||(b=a[e])}null!==b&&

29c=c[0]}b=c}null==b&&(b="");c=b}a._wrapperState={initialValue:Ua(c)}}function og(a,b){var c=Ua(b.value),d=Ua(b.defaultValue);null!=c&&(c=""+c,c!==a.value&&(a.value=

30function oe(a,b){return null==a||"http://www.w3.org/1999/xhtml"===a?qg(b):"http://www.w3.org/2000/svg"===a&&"foreignObject"===b?"http://www.w3.org/1999/xhtml":a}function rg(a,b,c){return null==b||"boolean"===typeof

31(null!=b.children||null!=b.dangerouslySetInnerHTML))throw Error(m(137,a));if(null!=b.dangerouslySetInnerHTML){if(null!=b.children)throw Error(m(60));if("object"!==typeof b.dangerouslySetInnerHTML||!("__html"in b.dangerouslySetInnerHTML))throw Error(m

32default:return!0}}function re(a){a=a.target||a.srcElement||window;a.correspondingUseElement&&(a=a.correspondingUseElement);return 3===a.nodeType?a.parentNode:a}function tg(a){if(a=ec(a)){if("function"!==typeof se)throw Error(

dist/cli/commands.jsView file

Lines 1-25javascript

1/**

2 * CLI command handlers

3 */

4import { resolve, dirname, join } from "path";

5import { existsSync, mkdirSync, readFileSync, copyFileSync } from "fs";

6import { createConnection } from "net";

7import { createRequire } from "module";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/commands.jsView on unpkg · L5

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/commands.jsView on unpkg · L5

8import { fileURLToPath } from "url";

9import { ConfigLoader, DEFAULT_DORAS, DEFAULT_EXITS } from "../config/loader.js";

10import { ipcSocketPath, ipcSocketSupportsFsExistenceCheck, } from "../daemon/ipc.js";

11import { DaemonServer } from "../daemon/server.js";

12import { Ipam } from "../ipam/ipam.js";

13import { Policy } from "../acl/policy.js";

14import { AclEngine } from "../acl/acl-engine.js";

15import { AuditLog } from "../acl/audit.js";

16import yaml from "js-yaml";

17import { startMultiExitRouter } from "../proxy/multi-exit-router.js";

18import { resolveEgressBindIp } from "../proxy/egress.js";

19import { startFriendUi } from "../ui/server.js";

20/**

21 * Refuse to open a second Carrier peer with this identity if the

22 * daemon is already running with the same keypair. Two peers sharing

23 * a keyfile race on session establishment, scramble each other's

24 * cookie/handshake state, and produce a stream of "Replacing stale

25 * session" log lines — the equivalent of two processes binding the