registry / @deepnoodle/mobius / 0.0.38

@deepnoodle/mobius@0.0.38

TypeScript SDK for Mobius agent loops and workers

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetworkWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 52.0 KB of source, external domains: api.mobiusops.ai, metadata.google.internal

Source & flagged code

2 flagged

dist/worker.jsView file

Lines 1-31javascript

1import { randomUUID } from "node:crypto";

2import { hostname as systemHostname } from "node:os";

3import { AuthRevokedError, WorkerInstanceConflictError, } from "./client.js";

4const CLOUD_RUN_METADATA_TIMEOUT_MS = 1000;

5const BOOT_INSTANCE_ID = randomUUID();

6export async function resolveInstanceID(explicit) {

7 if (explicit?.trim())

8 return { id: explicit.trim(), source: "configured" };

9 const cloudRun = await cloudRunInstanceID();

10 if (cloudRun)

11 return { id: cloudRun, source: "cloud_run_revision_instance" };

12 const hostname = (process.env.HOSTNAME ?? "").trim();

13 if (hostname)

14 return { id: hostname, source: "hostname" };

15 const fly = (process.env.FLY_MACHINE_ID ?? "").trim();

16 if (fly)

17 return { id: fly, source: "fly_machine_id" };

18 const railway = (process.env.RAILWAY_REPLICA_ID ?? "").trim();

19 if (railway)

20 return { id: railway, source: "railway_replica_id" };

21 const render = (process.env.RENDER_INSTANCE_ID ?? "").trim();

22 if (render)

23 return { id: render, source: "render_instance_id" };

24 try {

25 const host = systemHostname().trim();

26 if (host) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/worker.jsView on unpkg · L11

27 return {

28 id: `${host}-${BOOT_INSTANCE_ID.replace(/-/g, "").slice(0, 8)}`,

29 source: "system_hostname",

30 };

31 }

dist/client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @deepnoodle/mobius@0.0.36 matchedIdentity = npm:QGRlZXBub29kbGUvbW9iaXVz:0.0.36 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/client.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/worker.jsView file

11return { id: cloudRun, source: "cloud_run_revision_instance" }; L12: const hostname = (process.env.HOSTNAME ?? "").trim(); L13: if (hostname) ... L24: try { L25: const host = systemHostname().trim(); L26: if (host) { ... L45: try { L46: const resp = await fetch("http://metadata.google.[redacted]", { headers: { "Metadata-Flavor": "Google" }, signal: ctrl.signal }); L47: if (!resp.ok) L48: return null; L49: const id = (await resp.text()).trim(); L50: return id ? `${revision}-${id}` : null;

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/worker.jsView on unpkg · L11

dist/client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/client.jsView on unpkg

Findings

2 High2 Medium3 Low

HighCloud Metadata Accessdist/worker.js

HighPrevious Version Dangerous Deltadist/client.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowUrl Strings

Source & flagged code

2 flagged

dist/worker.jsView file

Lines 1-31javascript

1import { randomUUID } from "node:crypto";

2import { hostname as systemHostname } from "node:os";

3import { AuthRevokedError, WorkerInstanceConflictError, } from "./client.js";

4const CLOUD_RUN_METADATA_TIMEOUT_MS = 1000;

5const BOOT_INSTANCE_ID = randomUUID();

6export async function resolveInstanceID(explicit) {

7 if (explicit?.trim())

8 return { id: explicit.trim(), source: "configured" };

9 const cloudRun = await cloudRunInstanceID();

10 if (cloudRun)

11 return { id: cloudRun, source: "cloud_run_revision_instance" };

12 const hostname = (process.env.HOSTNAME ?? "").trim();

13 if (hostname)

14 return { id: hostname, source: "hostname" };

15 const fly = (process.env.FLY_MACHINE_ID ?? "").trim();

16 if (fly)

17 return { id: fly, source: "fly_machine_id" };

18 const railway = (process.env.RAILWAY_REPLICA_ID ?? "").trim();

19 if (railway)

20 return { id: railway, source: "railway_replica_id" };

21 const render = (process.env.RENDER_INSTANCE_ID ?? "").trim();

22 if (render)

23 return { id: render, source: "render_instance_id" };

24 try {

25 const host = systemHostname().trim();

26 if (host) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/worker.jsView on unpkg · L11

27 return {

28 id: `${host}-${BOOT_INSTANCE_ID.replace(/-/g, "").slice(0, 8)}`,

29 source: "system_hostname",

30 };

31 }

dist/client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/client.jsView on unpkg