registry / @deslop/workbench / 0.0.438

@deslop/workbench@0.0.438

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a user-invoked local workbench that can run terminals, Git, and configured AI agents through its local RPC server.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the `workbench` CLI and invokes terminal, Git, or agent actions.

Impact

High-capability actions require an explicit local user/workbench request; no install-time or covert persistence behavior was found.

Mechanism

Explicit local developer-workbench command orchestration.

Rationale

Static inspection found a bundled local developer workbench with expected terminal, Git, AI-agent, and provider SDK capabilities, but no lifecycle execution, credential harvesting, agent-control mutation, exfiltration, or covert payload chain. Scanner findings are explained by large bundled dependencies and frontend assets.

Evidence

package.jsondist/server.jsdist/google-shared-C8nQUN7A.mjs

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with medium false-positive risk.

Evidence for block

`dist/server.js` exposes terminal, Git, and AI-agent RPC handlers.
`dist/server.js` contains bundled agent/CLI dependencies with child-process and network primitives.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or uninstall hook.
The only package entrypoint is the explicit `workbench` CLI bin.
`dist/server.js` wires a local `/api/rpc` WebSocket server and user-requested terminal sessions.
No confirmed writes to `.claude`, `.codex`, `.cursor`, credentials, or other foreign agent-control paths were found.
No package-owned exfiltration endpoint or covert import-time payload was identified.
Scanner-hit `dist/google-shared-C8nQUN7A.mjs` execution is bundled Google authentication-library behavior, not package attack logic.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Source & flagged code

9 flagged

dist/google-shared-C8nQUN7A.mjsView file

8291const executable_response_1 = require_executable_response(); L8292: const childProcess = __require("child_process"); L8293: const fs$3 = __require("fs");

High

Child Process

Package source references child process execution.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L8291

2import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CC-oIOqs.mjs"; L3: import { Mi as import_websocket } from "./server.js"; L4: import { t as sanitizeSurrogates } from "./sanitize-unicode-DceI5AnU.mjs"; ... L15: if (typeof options === "boolean") options = { forever: options }; L16: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L17: this._timeouts = timeouts; ... L328: //#endregion L329: //#region ../../node_modules/.pnpm/gaxios@7.1.6/node_modules/gaxios/package.json L330: var require_package$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L610: if (!obj || typeof obj !== "object") return; L611: else if (obj instanceof FormData || obj instanceof URLSearchParams || "forEach" in obj && "set" in obj) obj.forEach((_, key) => {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/google-shared-C8nQUN7A.mjs spawns dist/dist-zHviHa-X.mjs; helper contains network access plus dynamic code execution. L2: import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CC-oIOqs.mjs"; L3: import { Mi as import_websocket } from "./server.js"; L4: import { t as sanitizeSurrogates } from "./sanitize-unicode-DceI5AnU.mjs"; ... L15: if (typeof options === "boolean") options = { forever: options }; L16: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L17: this._timeouts = timeouts; ... L328: //#endregion L329: //#region ../../node_modules/.pnpm/gaxios@7.1.6/node_modules/gaxios/package.json L330: var require_package$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L610: if (!obj || typeof obj

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

dist/photon_rs-CAtKufSV.mjsView file

Lines 4160-4200javascript

4160 module.exports.__wbg_height_3a8bec2f3fe71b26 = function(arg0) {

4161 return arg0.height;

4162 };

4163 module.exports.__wbg_setheight_1761808c18403921

dist/openai-codex-responses-D3EL6TtC.mjsView file

Lines 88-128javascript

88function resolveHttpProxyUrlForTarget(targetUrl, env) {

89 const proxy = getProxyForUrl(targetUrl, env);

90 if (!proxy) return;

dist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 10227778 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

•path = dist/server.js kind = oversized_cli_entrypoint sizeBytes = 10227778 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/google-shared-C8nQUN7A.mjsView file

8291const executable_response_1 = require_executable_response(); L8292: const childProcess = __require("child_process"); L8293: const fs$3 = __require("fs");

High

Child Process

Package source references child process execution.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L8291

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

Findings

1 Critical6 High7 Medium8 Low

CriticalTrojan Source Unicodedist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.js

HighChild Processdist/google-shared-C8nQUN7A.mjs

HighShell

HighCloud Metadata Accessdist/google-shared-C8nQUN7A.mjs

HighCross File Remote Execution Contextdist/google-shared-C8nQUN7A.mjs

HighShips High Entropy Blobdist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2

HighOversized Source Filedist/server.js

MediumDynamic Requiredist/openai-codex-responses-D3EL6TtC.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointdist/server.js