registry / @deepnoodle/mobius / 0.0.39

@deepnoodle/mobius@0.0.39

TypeScript SDK for Mobius agent loops and workers

Static Scan Results

scanned 38m ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetworkWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 52.0 KB of source, external domains: api.mobiusops.ai, metadata.google.internal

Source & flagged code

1 flagged

dist/worker.jsView file

Lines 1-31javascript

1import { randomUUID } from "node:crypto";

2import { hostname as systemHostname } from "node:os";

3import { AuthRevokedError, WorkerInstanceConflictError, } from "./client.js";

4const CLOUD_RUN_METADATA_TIMEOUT_MS = 1000;

5const BOOT_INSTANCE_ID = randomUUID();

6export async function resolveInstanceID(explicit) {

7 if (explicit?.trim())

8 return { id: explicit.trim(), source: "configured" };

9 const cloudRun = await cloudRunInstanceID();

10 if (cloudRun)

11 return { id: cloudRun, source: "cloud_run_revision_instance" };

12 const hostname = (process.env.HOSTNAME ?? "").trim();

13 if (hostname)

14 return { id: hostname, source: "hostname" };

15 const fly = (process.env.FLY_MACHINE_ID ?? "").trim();

16 if (fly)

17 return { id: fly, source: "fly_machine_id" };

18 const railway = (process.env.RAILWAY_REPLICA_ID ?? "").trim();

19 if (railway)

20 return { id: railway, source: "railway_replica_id" };

21 const render = (process.env.RENDER_INSTANCE_ID ?? "").trim();

22 if (render)

23 return { id: render, source: "render_instance_id" };

24 try {

25 const host = systemHostname().trim();

26 if (host) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/worker.jsView on unpkg · L11

27 return {

28 id: `${host}-${BOOT_INSTANCE_ID.replace(/-/g, "").slice(0, 8)}`,

29 source: "system_hostname",

30 };

31 }

Source & flagged code

1 flagged · loading source

dist/worker.jsView file

11return { id: cloudRun, source: "cloud_run_revision_instance" }; L12: const hostname = (process.env.HOSTNAME ?? "").trim(); L13: if (hostname) ... L24: try { L25: const host = systemHostname().trim(); L26: if (host) { ... L45: try { L46: const resp = await fetch("http://metadata.google.[redacted]", { headers: { "Metadata-Flavor": "Google" }, signal: ctrl.signal }); L47: if (!resp.ok) L48: return null; L49: const id = (await resp.text()).trim(); L50: return id ? `${revision}-${id}` : null;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/worker.jsView on unpkg · L11

Findings

1 High2 Medium3 Low

HighCloud Metadata Accessdist/worker.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

Source & flagged code

1 flagged

dist/worker.jsView file

Lines 1-31javascript

1import { randomUUID } from "node:crypto";

2import { hostname as systemHostname } from "node:os";

3import { AuthRevokedError, WorkerInstanceConflictError, } from "./client.js";

4const CLOUD_RUN_METADATA_TIMEOUT_MS = 1000;

5const BOOT_INSTANCE_ID = randomUUID();

6export async function resolveInstanceID(explicit) {

7 if (explicit?.trim())

8 return { id: explicit.trim(), source: "configured" };

9 const cloudRun = await cloudRunInstanceID();

10 if (cloudRun)

11 return { id: cloudRun, source: "cloud_run_revision_instance" };

12 const hostname = (process.env.HOSTNAME ?? "").trim();

13 if (hostname)

14 return { id: hostname, source: "hostname" };

15 const fly = (process.env.FLY_MACHINE_ID ?? "").trim();

16 if (fly)

17 return { id: fly, source: "fly_machine_id" };

18 const railway = (process.env.RAILWAY_REPLICA_ID ?? "").trim();

19 if (railway)

20 return { id: railway, source: "railway_replica_id" };

21 const render = (process.env.RENDER_INSTANCE_ID ?? "").trim();

22 if (render)

23 return { id: render, source: "render_instance_id" };

24 try {

25 const host = systemHostname().trim();

26 if (host) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/worker.jsView on unpkg · L11

27 return {

28 id: `${host}-${BOOT_INSTANCE_ID.replace(/-/g, "").slice(0, 8)}`,

29 source: "system_hostname",

30 };

31 }