registry / @deeeed/metamask-harness / 0.14.4

@deeeed/metamask-harness@0.14.4

Architecture: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 142 file(s), 864 KB of source, external domains: 127.0.0.1, metamask.github.io, nodejs.org, registry.npmjs.org

Source & flagged code

4 flagged

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 142-182javascript

142 client,

143 'globalThis?.__AGENTIC__?.getState()',

144 );

145 return state;

146 }

147 // Access Redux store at the given dot-path

148 const expr = `(() => {

149 const store = globalThis?.store;

150 if (!store) return { error: 'Redux store not found on globalThis.store' };

151 const state = store.getState();

152 const parts = ${JSON.stringify(path)}.split('.');

153 let current = state;

154 for (const p of parts) {

155 if (current == null) return undefined;

156 current = current[p];

157 }

158 return current;

159 })()`;

160 return await cdpEval(client, expr);

161 },

162

163 async eval(client, args) {

164 const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L162

165 if (!expression) {

166 throw new Error('Usage: eval <expression>');

167 }

168 return await cdpEval(client, expression);

169 },

170

171 async 'eval-async'(client, args) {

172 const expression = args.join(' ');

173 if (!expression) {

174 throw new Error('Usage: eval-async <expression>');

175 }

176 return await cdpEvalAsync(client, expression);

177 },

178

179 async 'can-go-back'(client) {

180 return await cdpEval(client, 'globalThis.__AGENTIC__?.canGoBack()');

181 },

182

dist/paths.jsView file

Lines 127-167javascript

127}

128async function importRecipeHarnessRuntimeReactNativeBridge() {

129 return importProtocolPackage(

130 "@farmslot/recipe-harness/runtime/react-native-bridge",

131 "packages/recipe-harness/src/runtime/react-native-bridge.ts"

132 );

133}

134async function importRecipeHarnessCli

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

adapters/extension/launch-browser.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deeeed/metamask-harness@0.14.1 matchedIdentity = npm:[redacted]:0.14.1 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/extension/launch-browser.cjsView on unpkg

Source & flagged code

4 flagged · loading source

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

162L163: async eval(client, args) { L164: const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L162

dist/paths.jsView file

147try { L148: return await import(packageName); L149: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/paths.jsView on unpkg · L147

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

adapters/extension/launch-browser.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/extension/launch-browser.cjsView on unpkg

Findings

1 High5 Medium7 Low

HighPrevious Version Dangerous Deltaadapters/extension/launch-browser.cjs

MediumDynamic Requiredist/paths.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperadapters/core/inject.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaladapters/mobile/bridge-runtime/cdp-bridge.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 142-182javascript

142 client,

143 'globalThis?.__AGENTIC__?.getState()',

144 );

145 return state;

146 }

147 // Access Redux store at the given dot-path

148 const expr = `(() => {

149 const store = globalThis?.store;

150 if (!store) return { error: 'Redux store not found on globalThis.store' };

151 const state = store.getState();

152 const parts = ${JSON.stringify(path)}.split('.');

153 let current = state;

154 for (const p of parts) {

155 if (current == null) return undefined;

156 current = current[p];

157 }

158 return current;

159 })()`;

160 return await cdpEval(client, expr);

161 },

162

163 async eval(client, args) {

164 const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L162

165 if (!expression) {

166 throw new Error('Usage: eval <expression>');

167 }

168 return await cdpEval(client, expression);

169 },

170

171 async 'eval-async'(client, args) {

172 const expression = args.join(' ');

173 if (!expression) {

174 throw new Error('Usage: eval-async <expression>');

175 }

176 return await cdpEvalAsync(client, expression);

177 },

178

179 async 'can-go-back'(client) {

180 return await cdpEval(client, 'globalThis.__AGENTIC__?.canGoBack()');

181 },

182

dist/paths.jsView file

Lines 127-167javascript

127}

128async function importRecipeHarnessRuntimeReactNativeBridge() {

129 return importProtocolPackage(

130 "@farmslot/recipe-harness/runtime/react-native-bridge",

131 "packages/recipe-harness/src/runtime/react-native-bridge.ts"

132 );

133}

134async function importRecipeHarnessCli

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

adapters/extension/launch-browser.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/extension/launch-browser.cjsView on unpkg