registry / @decentnetwork/peer / 0.1.74

@decentnetwork/peer@0.1.74

Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package implements an explicit P2P messaging peer that persists its own identity/friend state and talks to configured bootstrap, TURN, TCP relay, and optional HTTPS express relay endpoints.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs decent-peer subcommands or application code calls Peer.start()/joinNetwork()/send APIs.

Impact

Expected peer identity creation, message relay, and network traffic for the package's stated function; no unconsented install-time mutation or exfiltration found.

Mechanism

User-invoked P2P networking with local key/friend persistence

Rationale

Static source inspection shows suspicious primitives are package-aligned P2P, TURN/STUN, relay, and local identity persistence features invoked by users, with no install-time execution or concrete malicious chain. Mark clean.

Evidence

package.jsondist/index.jsdist/cli.jsdist/peer.jsdist/crypto/keypair.jsdist/compat/express.jsdist/stun.jsdist/turn.jsdist/turn-creds.jsdist/transport/udp.js~/.decent-peer/config.json~/.decent-peer/peer.save<keyFile><keyFile>.friends.json

Network endpoints3

47.100.103.201:33445tokyo.fi.chat:3478<express-node-host>:<express-node-port>/

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

Runtime network code connects to configured P2P bootstrap/TURN/relay nodes, including 47.100.103.201:33445 and tokyo.fi.chat:3478.
CLI and Peer.start create/read local identity/config files such as ~/.decent-peer/config.json, keyFile, and <keyFile>.friends.json.
dist/compat/express.js can POST/GET/DELETE encrypted offline relay messages over HTTPS to user/configured express nodes.

Evidence against

package.json has no preinstall/install/postinstall hook; only prepublishOnly build/typecheck script.
dist/index.js only re-exports modules; import does not start networking or filesystem writes.
Network/file behavior is activated by explicit CLI commands or Peer.start/joinNetwork and matches the documented P2P messaging purpose.
No child_process execution, eval/vm/Function, native addon, binary loading, credential harvesting, destructive action, or AI-agent control-surface writes found.
Hardcoded values are bootstrap/TURN relay addresses/credentials for the protocol, not exfiltration endpoints or embedded package secrets.

Behavioral surface

Source

CryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 44 file(s), 461 KB of source

Source & flagged code

2 flagged

dist/peer.jsView file

Lines 10-50javascript

10import { CRYPTO_PACKET_DHTPK, CRYPTO_PACKET_FRIEND_REQ, NET_PACKET_CRYPTO, createToxDhtCryptoRequest, openToxDhtCryptoRequest } from "./compat/tox-dht-crypto.js";

11import { NET_PACKET_PING_REQUEST, NET_PACKET_PING_RESPONSE, NET_PACKET_GET_NODES, NET_PACKET_SEND_NODES, encodeDhtRpc, decodeDhtRpc, buildPingPlain, parsePingPlain, buildGetNodesPlain, parseGetNodesPlain, buildSendNodesPlain, parseSendNodesNodeBytes, packUdpNodeV4 } from "./compat/dht-rpc.js";

12import { FileTransferManager, PACKET_ID_FILE_SENDREQUEST, PACKET_ID_FILE_CONTROL, PACKET_ID_FILE_DATA, PACKET_ID_FILE_FEC } from "./compat/filetransfer.js";

13import { NET_PACKET_CRYPTO_DATA, NET_PACKET_CRYPTO_HS, NET_PACKET_COOKIE_REQUEST, NET_PACKET_COOKIE_RESPONSE, createCookieRequest, createCookieResponse, createCryptoDataPacket, createCryptoHandshake, openCookieRequest, openCookieResponse, openCryptoDataPacket, openCryptoHandshake, incrementNonce } from "./compat/net-crypto.js";

14import { LegacyExpressClient } from "./compat/express.js";

15import { TcpRelayPool } from "./compat/tcp-relay-pool.js";

16import { LegacyDhtClient } from "./compat/dht.js";

17import { loadOrCreateKeyPair } from "./crypto/keypair.js";

18import { signDetached } from "./crypto/sign.js";

19import { base58ToBytes } from "./utils/base58.js";

20import { UdpTransport } from "./transport/udp.js";

21import { bytesToHex, concatBytes, randomBytes } from "./utils/bytes.js";

22import { buildBindingRequest, decodeStun, decodeXorMappedAddress, findAttr, STUN_ATTR_XOR_MAPPED_ADDRESS, STUN_BINDING_SUCCESS } from "./stun.js";

23import { TurnClient } from "./turn.js";

24import { createSocket as createDgramSocket } from "dgram";

25// Dedicated TURN relay servers — fixed public relays used as a stable

26// fallback path when direct UDP hole-punch fails or flaps (symmetric NAT,

27// NAT remaps, lossy direct path). A relay endpoint never NAT-flaps, so the

28// path stays put even when the peers' NATs churn. Static long-term creds.

29const TURN_RELAY_SERVERS = [

30 { host: "tokyo.fi.chat", port: 3478, username: "allcom", password: "allcompass" }

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/peer.jsView on unpkg · L30

31];

32const ANNOUNCE_WAIT_TIMEOUT_MS = readEnvInt("DECENT_ANNOUNCE_WAIT_TIMEOUT_MS", 4000);

33const MAX_FRIEND_ROUTE_ATTEMPTS = readEnvInt("DECENT_FRIEND_ROUTE_MAX_ATTEMPTS", 12);

34// How many in-flight announce step1 requests to fan out at once. Toxcore

35// pipelines all 12 of its onion clients in parallel; we batch up to this

36// many concurrent #sendAnnounceAndWait calls so the worst-case walk drops

37// from (per-node-timeout × 12) ≈ 60s down to ~10s. Configurable via

38// DECENT_FRIEND_ROUTE_BATCH_SIZE — set to 1 to revert to sequential.

39const FRIEND_ROUTE_BATCH_SIZE = readEnvInt("DECENT_FRIEND_ROUTE_BATCH_SIZE", 8);

40// Node soft-blacklist: after N consecutive failures (timeouts) a node

41// is parked for a TTL window so we don't waste batch slots on it.

42// Set NODE_BLACKLIST_THRESHOLD=0 to disable. Successful response from

43// the same node clears it instantly.

44const NODE_BLACKLIST_THRESHOLD = readEnvInt("DECENT_NODE_BLACKLIST_THRESHOLD", 5);

45const NODE_BLACKLIST_BASE_TTL_MS = readEnvInt("DECENT_NODE_BLACKLIST_BASE_TTL_MS", 60_000);

46const NODE_BLACKLIST_MAX_TTL_MS = readEnvInt("DECENT_NODE_BLACKLIST_MAX_TTL_MS", 600_000);

47const FRIEND_ANNOUNCE_ATTEMPTS = readEnvInt("DECENT_FRIEND_ANNOUNCE_ATTEMPTS", 1);

48const JOIN_ANNOUNCE_TIMEOUT_MS = readEnvInt("DECENT_JOIN_ANNOUNCE_TIMEOUT_MS", 12000);

49const SELF_ANNOUNCE_INTERVAL_MS = readEnvInt("DECENT_SELF_ANNOUNCE_INTERVAL_MS", 20000);

50// Classic-DHT maintenance cadence. Every tick we get_nodes toward our own key

dist/stun.jsView file

Lines 103-143javascript

103 * MESSAGE-INTEGRITY attribute (HMAC-SHA1) is appended. If `fingerprint`

104 * is true, a FINGERPRINT (CRC32 XOR 0x5354554e) is appended last.

105 *

106 * The order matters because MESSAGE-

Source & flagged code

2 flagged · loading source

dist/peer.jsView file

30patternName = generic_password severity = medium line = 30 matchedText = { host: ...s" }

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/peer.jsView on unpkg · L30

dist/stun.jsView file

123const hmacInput = concatBytes([headerForHmac, body]); L124: const hmac = createHmac("sha1", Buffer.from(opts.integrityKey)).update(hmacInput).digest(); L125: body = concatBytes([

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/stun.jsView on unpkg · L123

Findings

3 Medium6 Low

MediumSecret Patterndist/peer.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/stun.js

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License