registry / @deeeed/metamask-harness / 0.17.4

@deeeed/metamask-harness@0.17.4

`mm-harness` gives people and agents one CLI for operating MetaMask Mobile, Extension, and Core. Run it inside a checkout; the product is auto-detected.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 161 file(s), 1.04 MB of source, external domains: 127.0.0.1, metamask.github.io, nodejs.org, registry.npmjs.org, www.w3.org

Source & flagged code

7 flagged

dist/commands/fixtures.jsView file

Lines 394-434javascript

394 fs.lstatSync(canonical);

395 return usageOut(json, "fixtures", `wallet fixture already exists: ${canonical}`, "re-run with --force only when replacement is intentional");

396 } catch (error) {

397 if (error.code !== "ENOENT") throw error;

398 }

399 }

400 fs.mkdirSync(path.dirname(canonical), { recursive: true });

401 let fixtureBytes;

402 if (source) {

403 const resolvedSource = path.resolve(source);

404 try {

405 fixtureBytes = fs.readFileSync(resolvedSource);

406 } catch (error) {

407 if (error.code === "ENOENT") {

408 return usageOut(json, "fixtures", `wallet fixture source does not exist: ${resolvedSource}`, "pass an existing JSON file to --from");

409 }

410 throw error;

411 }

412 } else {

413 const fixture = {

414 password: "metamask",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/fixtures.jsView on unpkg · L414

415 accounts: [{

416 type: "mnemonic",

417 value: "test test test test test test test test test test test junk",

418 name: "dev1",

419 count: 1,

420 names: ["dev1"]

421 }],

422 settings: { skipPerpsTutorial: true, autoLockNever: true }

423 };

424 fixtureBytes = `${JSON.stringify(fixture, null, 2)}

425`;

426 }

427 const temporary = `${canonical}.${process.pid}.${randomUUID()}.tmp`;

428 let descriptor = null;

429 try {

430 descriptor = fs.openSync(

431 temporary,

432 fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,

433 384

434 );

dist/runtime-context.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { execFileSync } from "node:child_process";

3import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/runtime-context.jsView on unpkg · L1

4import os from "node:os";

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 142-182javascript

142 client,

143 'globalThis?.__AGENTIC__?.getState()',

144 );

145 return state;

146 }

147 // Access Redux store at the given dot-path

148 const expr = `(() => {

149 const store = globalThis?.store;

150

dist/paths.jsView file

Lines 124-164javascript

124}

125async function importRecipeHarnessRuntimeReactNativeBridge() {

126 return importProtocolPackage(

127 "@farmslot/recipe-harness/runtime/react-native-bridge",

128 "packages/recipe-harness/src/runtime/react-native-bridge.ts"

129 );

130}

131async function importRecipeHarnessCli

dist/adapters/extension/console-capture.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import fs from "node:fs";

3import path from "node:path";

4import { recipeRuntimePath, runnerDir } from "../../paths.js";

5async function ensureExtensionConsoleCapture(

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

adapters/extension/launch-webpack.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deeeed/metamask-harness@0.17.0 matchedIdentity = npm:[redacted]:0.17.0 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/extension/launch-webpack.cjsView on unpkg

Source & flagged code

7 flagged · loading source

dist/commands/fixtures.jsView file

414patternName = generic_password severity = medium line = 414 matchedText = password...sk",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/fixtures.jsView on unpkg · L414

dist/runtime-context.jsView file

1import { createHash } from "node:crypto"; L2: import { execFileSync } from "node:child_process"; L3: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/runtime-context.jsView on unpkg · L1

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

162L163: async eval(client, args) { L164: const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L162

dist/paths.jsView file

144try { L145: return await import(packageName); L146: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/paths.jsView on unpkg · L144

dist/adapters/extension/console-capture.jsView file

1import { spawn, spawnSync } from "node:child_process"; L2: import fs from "node:fs"; ... L5: async function ensureExtensionConsoleCapture(target) { L6: const cdpPort = process.env.CDP_PORT ?? process.env.RECIPE_CDP_PORT; L7: if (!cdpPort) throw new Error("Extension console capture requires a resolved CDP port."); L8: const response = await fetch(`http://127.0.0.1:${cdpPort}/json/version`); L9: if (!response.ok) throw new Error(`Extension CDP ${cdpPort} is not ready for console capture.`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/adapters/extension/console-capture.jsView on unpkg · L1

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

adapters/extension/launch-webpack.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/extension/launch-webpack.cjsView on unpkg

Findings

4 High6 Medium7 Low

HighChild Processdist/runtime-context.js

HighShell

HighSame File Env Network Executiondist/adapters/extension/console-capture.js

HighPrevious Version Dangerous Deltaadapters/extension/launch-webpack.cjs

MediumSecret Patterndist/commands/fixtures.js

MediumDynamic Requiredist/paths.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperadapters/core/inject.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaladapters/mobile/bridge-runtime/cdp-bridge.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

dist/commands/fixtures.jsView file

Lines 394-434javascript

394 fs.lstatSync(canonical);

395 return usageOut(json, "fixtures", `wallet fixture already exists: ${canonical}`, "re-run with --force only when replacement is intentional");

396 } catch (error) {

397 if (error.code !== "ENOENT") throw error;

398 }

399 }

400 fs.mkdirSync(path.dirname(canonical), { recursive: true });

401 let fixtureBytes;

402 if (source) {

403 const resolvedSource = path.resolve(source);

404 try {

405 fixtureBytes = fs.readFileSync(resolvedSource);

406 } catch (error) {

407 if (error.code === "ENOENT") {

408 return usageOut(json, "fixtures", `wallet fixture source does not exist: ${resolvedSource}`, "pass an existing JSON file to --from");

409 }

410 throw error;

411 }

412 } else {

413 const fixture = {

414 password: "metamask",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/fixtures.jsView on unpkg · L414

415 accounts: [{

416 type: "mnemonic",

417 value: "test test test test test test test test test test test junk",

418 name: "dev1",

419 count: 1,

420 names: ["dev1"]

421 }],

422 settings: { skipPerpsTutorial: true, autoLockNever: true }

423 };

424 fixtureBytes = `${JSON.stringify(fixture, null, 2)}

425`;

426 }

427 const temporary = `${canonical}.${process.pid}.${randomUUID()}.tmp`;

428 let descriptor = null;

429 try {

430 descriptor = fs.openSync(

431 temporary,

432 fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,

433 384

434 );

dist/runtime-context.jsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { execFileSync } from "node:child_process";

3import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/runtime-context.jsView on unpkg · L1

4import os from "node:os";

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 142-182javascript

142 client,

143 'globalThis?.__AGENTIC__?.getState()',

144 );

145 return state;

146 }

147 // Access Redux store at the given dot-path

148 const expr = `(() => {

149 const store = globalThis?.store;

150

dist/paths.jsView file

Lines 124-164javascript

124}

125async function importRecipeHarnessRuntimeReactNativeBridge() {

126 return importProtocolPackage(

127 "@farmslot/recipe-harness/runtime/react-native-bridge",

128 "packages/recipe-harness/src/runtime/react-native-bridge.ts"

129 );

130}

131async function importRecipeHarnessCli

dist/adapters/extension/console-capture.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import fs from "node:fs";

3import path from "node:path";

4import { recipeRuntimePath, runnerDir } from "../../paths.js";

5async function ensureExtensionConsoleCapture(

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7743 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

adapters/extension/launch-webpack.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

adapters/extension/launch-webpack.cjsView on unpkg