registry / @deeeed/metamask-harness / 0.3.8

@deeeed/metamask-harness@0.3.8

Architecture: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

Manifest

NoLicense

scanned 94 file(s), 703 KB of source, external domains: 127.0.0.1, nodejs.org, registry.npmjs.org

Source & flagged code

4 flagged

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 123-163javascript

123 client,

124 'globalThis?.__AGENTIC__?.getState()',

125 );

126 return state;

127 }

128 // Access Redux store at the given dot-path

129 const expr = `(() => {

130 const store = globalThis?.store;

131 if (!store) return { error: 'Redux store not found on globalThis.store' };

132 const state = store.getState();

133 const parts = ${JSON.stringify(path)}.split('.');

134 let current = state;

135 for (const p of parts) {

136 if (current == null) return undefined;

137 current = current[p];

138 }

139 return current;

140 })()`;

141 return await cdpEval(client, expr);

142 },

143

144 async eval(client, args) {

145 const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L143

146 if (!expression) {

147 throw new Error('Usage: eval <expression>');

148 }

149 return await cdpEval(client, expression);

150 },

151

152 async 'eval-async'(client, args) {

153 const expression = args.join(' ');

154 if (!expression) {

155 throw new Error('Usage: eval-async <expression>');

156 }

157 return await cdpEvalAsync(client, expression);

158 },

159

160 async 'can-go-back'(client) {

161 return await cdpEval(client, 'globalThis.__AGENTIC__?.canGoBack()');

162 },

163

library/actions/core/perps/_controller.mjsView file

Lines 289-329javascript

289 );

290 }

291 return raw;

292}

293

294/**

295 * Instantiate the PerpsController headlessly against the resolved core checkout.

296 * Returns the controller plus the resolved read account address. Cached per

297 * process so repeated reads in one adapter invocation reuse one controller.

298 */

299export async

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7205 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

src/commands/shared.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deeeed/metamask-harness@0.3.7 matchedIdentity = npm:[redacted]:0.3.7 similarity = 0.979 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/shared.tsView on unpkg

Source & flagged code

4 flagged · loading source

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

143L144: async eval(client, args) { L145: const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L143

library/actions/core/perps/_controller.mjsView file

309const [{ PerpsController }, { Messenger, MOCK_ANY_NAMESPACE }] = await Promise.all([ L310: import(controllerEntry(projectRoot)), L311: import(messengerEntry(projectRoot)),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

library/actions/core/perps/_controller.mjsView on unpkg · L309

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7205 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

src/commands/shared.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/shared.tsView on unpkg

Findings

1 High5 Medium7 Low

HighPrevious Version Dangerous Deltasrc/commands/shared.ts

MediumDynamic Requirelibrary/actions/core/perps/_controller.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperadapters/core/inject.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaladapters/mobile/bridge-runtime/cdp-bridge.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

adapters/mobile/bridge-runtime/cdp-bridge.cjsView file

Lines 123-163javascript

123 client,

124 'globalThis?.__AGENTIC__?.getState()',

125 );

126 return state;

127 }

128 // Access Redux store at the given dot-path

129 const expr = `(() => {

130 const store = globalThis?.store;

131 if (!store) return { error: 'Redux store not found on globalThis.store' };

132 const state = store.getState();

133 const parts = ${JSON.stringify(path)}.split('.');

134 let current = state;

135 for (const p of parts) {

136 if (current == null) return undefined;

137 current = current[p];

138 }

139 return current;

140 })()`;

141 return await cdpEval(client, expr);

142 },

143

144 async eval(client, args) {

145 const expression = args.join(' ');

Low

Eval

Package source references a known benign dynamic code generation pattern.

adapters/mobile/bridge-runtime/cdp-bridge.cjsView on unpkg · L143

146 if (!expression) {

147 throw new Error('Usage: eval <expression>');

148 }

149 return await cdpEval(client, expression);

150 },

151

152 async 'eval-async'(client, args) {

153 const expression = args.join(' ');

154 if (!expression) {

155 throw new Error('Usage: eval-async <expression>');

156 }

157 return await cdpEvalAsync(client, expression);

158 },

159

160 async 'can-go-back'(client) {

161 return await cdpEval(client, 'globalThis.__AGENTIC__?.canGoBack()');

162 },

163

library/actions/core/perps/_controller.mjsView file

Lines 289-329javascript

289 );

290 }

291 return raw;

292}

293

294/**

295 * Instantiate the PerpsController headlessly against the resolved core checkout.

296 * Returns the controller plus the resolved read account address. Cached per

297 * process so repeated reads in one adapter invocation reuse one controller.

298 */

299export async

adapters/core/inject.shView file

•path = adapters/core/inject.sh kind = build_helper sizeBytes = 7205 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

adapters/core/inject.shView on unpkg

src/commands/shared.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/shared.tsView on unpkg