registry / @decentnetwork/peer / 0.1.73

@decentnetwork/peer@0.1.73

Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network and file writes are package-aligned peer messaging behavior activated by library/CLI use.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports library and calls Peer.start/joinNetwork, or runs decent-peer CLI commands.

Impact

Creates local peer identity/config/friend state and contacts configured bootstrap/relay nodes for messaging.

Mechanism

P2P messaging client with UDP/TCP/TURN/HTTPS relay support and local peer state persistence.

Rationale

Static inspection shows a legitimate P2P messaging package whose network, env var, crypto, and local file operations are consistent with user-invoked peer functionality. Scanner hits such as hardcoded relay credentials and MD5/STUN code are protocol/service details, not evidence of malware.

Evidence

package.jsondist/index.jsdist/cli.jsdist/peer.jsdist/crypto/keypair.jsdist/compat/express.jsdist/transport/udp.js~/.decent-peer/config.json~/.decent-peer/peer.save<keyFile>.friends.json

Network endpoints3

47.100.103.201:33445tokyo.fi.chat:3478${node.host}:${node.port}/${path}

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall hooks; only prepublishOnly build/typecheck.
dist/index.js only re-exports modules; no import-time execution beyond constants.
dist/cli.js writes config only via explicit decent-peer init and uses DECENT_PEER_CONFIG override.
dist/peer.js network behavior is P2P/DHT/TURN/relay functionality aligned with package purpose.
dist/crypto/keypair.js creates/reads only the configured peer identity key file.
No child_process, eval, Function, dynamic remote code loading, credential harvesting, or AI-agent config mutation found.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 43 file(s), 446 KB of source

Source & flagged code

2 flagged

dist/peer.jsView file

Lines 10-50javascript

10import { CRYPTO_PACKET_DHTPK, CRYPTO_PACKET_FRIEND_REQ, NET_PACKET_CRYPTO, createToxDhtCryptoRequest, openToxDhtCryptoRequest } from "./compat/tox-dht-crypto.js";

11import { NET_PACKET_PING_REQUEST, NET_PACKET_PING_RESPONSE, NET_PACKET_GET_NODES, NET_PACKET_SEND_NODES, encodeDhtRpc, decodeDhtRpc, buildPingPlain, parsePingPlain, buildGetNodesPlain, parseGetNodesPlain, buildSendNodesPlain, parseSendNodesNodeBytes, packUdpNodeV4 } from "./compat/dht-rpc.js";

12import { FileTransferManager, PACKET_ID_FILE_SENDREQUEST, PACKET_ID_FILE_CONTROL, PACKET_ID_FILE_DATA } from "./compat/filetransfer.js";

13import { NET_PACKET_CRYPTO_DATA, NET_PACKET_CRYPTO_HS, NET_PACKET_COOKIE_REQUEST, NET_PACKET_COOKIE_RESPONSE, createCookieRequest, createCookieResponse, createCryptoDataPacket, createCryptoHandshake, openCookieRequest, openCookieResponse, openCryptoDataPacket, openCryptoHandshake, incrementNonce } from "./compat/net-crypto.js";

14import { LegacyExpressClient } from "./compat/express.js";

15import { TcpRelayPool } from "./compat/tcp-relay-pool.js";

16import { LegacyDhtClient } from "./compat/dht.js";

17import { loadOrCreateKeyPair } from "./crypto/keypair.js";

18import { signDetached } from "./crypto/sign.js";

19import { base58ToBytes } from "./utils/base58.js";

20import { UdpTransport } from "./transport/udp.js";

21import { bytesToHex, concatBytes, randomBytes } from "./utils/bytes.js";

22import { buildBindingRequest, decodeStun, decodeXorMappedAddress, findAttr, STUN_ATTR_XOR_MAPPED_ADDRESS, STUN_BINDING_SUCCESS } from "./stun.js";

23import { TurnClient } from "./turn.js";

24import { createSocket as createDgramSocket } from "dgram";

25// Dedicated TURN relay servers — fixed public relays used as a stable

26// fallback path when direct UDP hole-punch fails or flaps (symmetric NAT,

27// NAT remaps, lossy direct path). A relay endpoint never NAT-flaps, so the

28// path stays put even when the peers' NATs churn. Static long-term creds.

29const TURN_RELAY_SERVERS = [

30 { host: "tokyo.fi.chat", port: 3478, username: "allcom", password: "allcompass" }

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/peer.jsView on unpkg · L30

31];

32const ANNOUNCE_WAIT_TIMEOUT_MS = readEnvInt("DECENT_ANNOUNCE_WAIT_TIMEOUT_MS", 4000);

33const MAX_FRIEND_ROUTE_ATTEMPTS = readEnvInt("DECENT_FRIEND_ROUTE_MAX_ATTEMPTS", 12);

34// How many in-flight announce step1 requests to fan out at once. Toxcore

35// pipelines all 12 of its onion clients in parallel; we batch up to this

36// many concurrent #sendAnnounceAndWait calls so the worst-case walk drops

37// from (per-node-timeout × 12) ≈ 60s down to ~10s. Configurable via

38// DECENT_FRIEND_ROUTE_BATCH_SIZE — set to 1 to revert to sequential.

39const FRIEND_ROUTE_BATCH_SIZE = readEnvInt("DECENT_FRIEND_ROUTE_BATCH_SIZE", 8);

40// Node soft-blacklist: after N consecutive failures (timeouts) a node

41// is parked for a TTL window so we don't waste batch slots on it.

42// Set NODE_BLACKLIST_THRESHOLD=0 to disable. Successful response from

43// the same node clears it instantly.

44const NODE_BLACKLIST_THRESHOLD = readEnvInt("DECENT_NODE_BLACKLIST_THRESHOLD", 5);

45const NODE_BLACKLIST_BASE_TTL_MS = readEnvInt("DECENT_NODE_BLACKLIST_BASE_TTL_MS", 60_000);

46const NODE_BLACKLIST_MAX_TTL_MS = readEnvInt("DECENT_NODE_BLACKLIST_MAX_TTL_MS", 600_000);

47const FRIEND_ANNOUNCE_ATTEMPTS = readEnvInt("DECENT_FRIEND_ANNOUNCE_ATTEMPTS", 1);

48const JOIN_ANNOUNCE_TIMEOUT_MS = readEnvInt("DECENT_JOIN_ANNOUNCE_TIMEOUT_MS", 12000);

49const SELF_ANNOUNCE_INTERVAL_MS = readEnvInt("DECENT_SELF_ANNOUNCE_INTERVAL_MS", 20000);

50// Classic-DHT maintenance cadence. Every tick we get_nodes toward our own key

dist/stun.jsView file

Lines 103-143javascript

103 * MESSAGE-INTEGRITY attribute (HMAC-SHA1) is appended. If `fingerprint`

104 * is true, a FINGERPRINT (CRC32 XOR 0x5354554e) is appended last.

105 *

106 * The order matters because MESSAGE-

Source & flagged code

2 flagged · loading source

dist/peer.jsView file

30patternName = generic_password severity = medium line = 30 matchedText = { host: ...s" }

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/peer.jsView on unpkg · L30

dist/stun.jsView file

123const hmacInput = concatBytes([headerForHmac, body]); L124: const hmac = createHmac("sha1", Buffer.from(opts.integrityKey)).update(hmacInput).digest(); L125: body = concatBytes([

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stun.jsView on unpkg · L123

Findings

3 Medium6 Low

MediumSecret Patterndist/peer.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/stun.js

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License