Loading npm security reports…

@desplega.ai/agent-swarm: Manual Review npm security report | LPM Firewall

registry / @desplega.ai/agent-swarm / 1.165.0

@desplega.ai/agent-swarm@1.165.0

⚠ Under review

agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules,

AI Security Review

scanned 21h ago · by lpm-firewall-ai

No attack was confirmed from the inspected source. The flagged network and credential behavior did not establish an attack surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

No malicious activation trigger was established in the inspected source.

Impact

No malicious impact was confirmed.

Mechanism

The reviewed server path validates OAuth metadata destinations, and the authentication-file write is in a CLI utility.

AI rationale

Inspected source did not substantiate the scanner’s exfiltration claim or establish malicious install-time behavior. Clean citation coverage requires more citations than the schema allows, so the result is manual review rather than a clean verdict.

Decision evidence

public snapshot

AI called this Manual Review at 76.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest defines CLI and module entrypoints but no registry install lifecycle hook.
The Codex authentication-file write appears in a CLI utility; inspected source does not establish that it runs during package installation.
OAuth metadata requests validate destinations with a URL safety check; the flagged server source does not establish credential exfiltration.

Source & flagged code

28 flagged

dist/cli-nvvfd8bq.jsView file

32352// node_modules/@earendil-works/pi-coding-agent/dist/core/exec.js L32353: import { spawn } from "node:child_process"; L32354: async function execCommand(command, args, cwd, options) {

High

Child Process

Package source references child process execution.

dist/cli-nvvfd8bq.jsView on unpkg · L32352

58formatToolCallWithArgs, L59: getPowerShellConfig, L60: getShellConfig,

High

Shell

Package source references shell execution.

dist/cli-nvvfd8bq.jsView on unpkg · L58

1152var require_util = __commonJS(function(exports, module) { L1153: var assert = __require("node:assert"); L1154: var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-nvvfd8bq.jsView on unpkg · L1152

dist/photon_rs-q3vet37k.jsView file

Lines 1176-1216javascript

1176 return ret;

1177};

1178var $__wbg_setheight_1761808c18403921 = function(arg0, arg1) {

1179 arg0.height = arg1 >>> 0;

1180};

1181

src/tests/page-proxy.test.tsView file

Lines 1-34typescript

1/**

2 * Integration tests for the page-session cookie flow:

3 * 1. Create a page (bearer-auth) → POST /api/pages

4 * 2. Launch it → POST /api/pages/:id/launch → captures Set-Cookie

5 * 3. Hit /@swarm/api/* with the cookie. The proxy injects the server bearer

6 * and verified page context while preserving the viewer's identity.

7 *

8 * Spawns the real `src/http.ts` server with API_KEY set so we exercise the

9 * full bearer + cookie + proxy chain, not the in-process handler in

10 * isolation.

dist/cli-0n4fasz0.jsView file

11831} L11832: function combineURLs(baseURL, relativeURL) { L11833: return relativeURL ? baseURL.replace(/\/?\/$/, "") + "/" + relativeURL.replace(/^\/+/, "") : baseURL; ... L20629: try { L20630: data = node_fs_1.default.readFileSync(node_path_1.default.resolve("".concat(installationDir, "/app-latest"))); L20631: installation = JSON.parse(data.toString());

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-0n4fasz0.jsView on unpkg · L11831

25require_subprotocol, L26: require_websocket, L27: require_websocket_server ... L234: L235: // node_modules/@slack/web-api/package.json L236: var require_package = __commonJS(function(exports, module) { ... L292: eventemitter3: "^5.0.1", L293: "form-data": "^4.0.4", L294: "is-electron": "2.2.2", ... L10453: } else { L10454: dataBuffer = Buffer.concat([dataBuffer, Buffer.from(this._streams[i])]); L10455: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-0n4fasz0.jsView on unpkg · L25

dist/index-fdk1t4d6.jsView file

91092await i2(n2.loginUrl), s2 = true; L91093: else if (i2 && (o2 = n2.loginUrl, !process.env.NO_OPEN_BROWSER && !Boolean(process.env.SSH_CONNECTION ?? process.env.SSH_CLIENT ?? process.env.SSH_TTY) && it(o2))) L91094: try { ... L91098: const r3 = process.platform; L91099: return r3 === "darwin" ? { cmd: "open", args: [t4] } : r3 === "win32" ? { cmd: st.join(process.env.SYSTEMROOT ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell... L91100: }(t3), i3 = (0, nt.spawn)(n3, s3, { stdio: "ignore", windowsHide: true }); ... L91103: }), i3.once("spawn", () => r2()), i3.unref(); L91104: }) : Promise.reject(new Error(`Invalid URL: only http:// and https:// links can be opened. Received: ${t3}`)); L91105: }(n2.loginUrl), s2 = true;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index-fdk1t4d6.jsView on unpkg · L91092

91098const r3 = process.platform; L91099: return r3 === "darwin" ? { cmd: "open", args: [t4] } : r3 === "win32" ? { cmd: st.join(process.env.SYSTEMROOT ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell... L91100: }(t3), i3 = (0, nt.spawn)(n3, s3, { stdio: "ignore", windowsHide: true }); ... L91103: }), i3.once("spawn", () => r2()), i3.unref(); L91104: }) : Promise.reject(new Error(`Invalid URL: only http:// and https:// links can be opened. Received: ${t3}`)); L91105: }(n2.loginUrl), s2 = true; ... L91107: var o2; L91108: s2 || process.stderr.write(`Could not open a browser. Open this URL to sign in to Cursor: L91109:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index-fdk1t4d6.jsView on unpkg · L91098

src/http/script-connections.tsView file

Lines 1-21typescript

1import type { IncomingMessage, ServerResponse } from "node:http";

2import { z } from "zod";

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/http/script-connections.tsView on unpkg · L1

3import { resolveHttpAuditUserId } from

dist/claude-sdk-session-9re1g7r2.jsView file

21SessionErrorTracker, L22: parseStderrForErrors, L23: redactRateLimitEvent, ... L108: import { constants as $c, createWriteStream as yye } from "fs"; L109: import { execFile as gye } from "child_process"; L110: import { promisify as hye } from "util"; ... L133: import { posix as cze, win32 as uze } from "path"; L134: import { isIPv4 as qFe, isIPv6 as ZFe } from "net"; L135: import { userInfo as Nje } from "os"; ... L1269: Object.defineProperty(sF, "__esModule", { value: true }); L1270: var Ue = Te(), TTe = { data: new Ue.Name("data"), valCxt: new Ue.Name("valCxt"), instancePath: new Ue.Name("instancePath"), parentData: new Ue.Name("parentData"), parentDataPropert... L1271: sF.default = TTe;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/claude-sdk-session-9re1g7r2.jsView on unpkg · L21

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/claude-sdk-session-9re1g7r2.jsView on unpkg · L21

dist/cli-ng97fjq7.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli-ng97fjq7.js: const match = (headers?.authorization ?? "").match(/Signature=(\w+)$/); const match = request.headers?.authorization?.match(/Signature=([\w]+)$/); var { writeFile } = promises; return writeFile(tokenFilepath, tokenString); "Proxy-Authorization": `Negotiate ${token}` headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`; headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`; headers["Proxy-Authorization"] = `Basic ${Buffer.from(auth).toString("base64")}`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-ng97fjq7.jsView on unpkg

dist/http-w40q4w94.jsView file

578Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/http-w40q4w94.js L578: import { L579: import_websocket, L580: import_websocket_server ... L1317: end: () => { L1318: bestEffortTelemetry("span.end", () => span.end()); L1319: } ... L1335: } L1336: function readPositiveIntEnv(key, env = process.env) { L1337: const raw = env[key]?.trim(); ... L2085: const bytes = crypto.getRandomValues(new Uint8Array(24)); L2086: ticket = Buffer.from(bytes).toString("base64url"); L2087: } while (tickets.has(ticket));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/http-w40q4w94.jsView on unpkg · L578

dist/quickjs-r1pq2107.wasmView file

•path = dist/quickjs-r1pq2107.wasm kind = wasm_module sizeBytes = 637405 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/quickjs-r1pq2107.wasmView on unpkg

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-xtgtyafv.jsView file

•path = dist/cli-xtgtyafv.js kind = oversized_source_file sizeBytes = 9391014 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-xtgtyafv.jsView on unpkg

dist/cli-50eg13rj.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-50eg13rj.jsView on unpkg

dist/cli-5bfdm1ah.jsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = dist/cli-5bfdm1ah.js matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-5bfdm1ah.jsView on unpkg

dist/cli-q51yprfq.jsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = dist/cli-q51yprfq.js matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-q51yprfq.jsView on unpkg

dist/cli-zn2v3t8v.jsView file

•matchType = token_shingles matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = dist/cli-5my3bjsd.js matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-zn2v3t8v.jsView on unpkg

src/script-workflows/executor.tsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = src/script-workflows/executor.ts matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/script-workflows/executor.tsView on unpkg

dist/claude-k04qfvsv.jsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = dist/claude-k04qfvsv.js matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-k04qfvsv.jsView on unpkg

src/http/metrics.tsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = src/http/metrics.ts matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/metrics.tsView on unpkg

src/http/pages-public.tsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = src/http/pages-public.ts matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/pages-public.tsView on unpkg

src/http/x.tsView file

•matchType = normalized_sha256 matchedPackage = @desplega.ai/agent-swarm@1.149.1 matchedPath = src/http/x.ts matchedIdentity = npm:[redacted]:1.149.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/x.tsView on unpkg

dist/cli-bns5c8k9.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @desplega.ai/agent-swarm@1.164.1 matchedIdentity = npm:[redacted]:1.164.1 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-bns5c8k9.jsView on unpkg

Source & flagged code

28 flagged · loading source

dist/cli-nvvfd8bq.jsView file

32352// node_modules/@earendil-works/pi-coding-agent/dist/core/exec.js L32353: import { spawn } from "node:child_process"; L32354: async function execCommand(command, args, cwd, options) {

High

Child Process

Package source references child process execution.

dist/cli-nvvfd8bq.jsView on unpkg · L32352

58formatToolCallWithArgs, L59: getPowerShellConfig, L60: getShellConfig,

High

Shell

Package source references shell execution.

dist/cli-nvvfd8bq.jsView on unpkg · L58

1152var require_util = __commonJS(function(exports, module) { L1153: var assert = __require("node:assert"); L1154: var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-nvvfd8bq.jsView on unpkg · L1152

dist/photon_rs-q3vet37k.jsView file

1196var $__wbg_newnoargs_e643855c6572a4a8 = function(arg0, arg1) { L1197: const ret = new Function(getStringFromWasm0(arg0, arg1)); L1198: return ret;

High

Eval

Package source references dynamic code evaluation.

dist/photon_rs-q3vet37k.jsView on unpkg · L1196

src/tests/page-proxy.test.tsView file

14import { unlink } from "node:fs/promises"; L15: import net from "node:net"; L16: import { runInNewContext } from "node:vm"; ... L39: }, L40: body: JSON.stringify({ L41: name, ... L49: if (res.status !== 201 && res.status !== 200) { L50: throw new Error(`Failed to register agent: ${res.status} ${await res.text()}`); L51: } ... L65: // signPageSession() in-process validate at the proxy. L66: process.env.PAGE_SESSION_SECRET = PAGE_SECRET; L67:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/tests/page-proxy.test.tsView on unpkg · L14

dist/cli-0n4fasz0.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-0n4fasz0.jsView on unpkg · L11831

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-0n4fasz0.jsView on unpkg · L25

dist/index-fdk1t4d6.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index-fdk1t4d6.jsView on unpkg · L91092

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index-fdk1t4d6.jsView on unpkg · L91098

src/http/script-connections.tsView file

1import type { IncomingMessage, ServerResponse } from "node:http"; L2: import { z } from "zod"; ... L304: .optional(), L305: hasBody: z.boolean().optional(), L306: successStatus: z.string().optional(), ... L1186: try { L1187: const runtime = JSON.parse(connection.generatedRuntimeJson) as { L1188: operations?: unknown; ... L1684: try { L1685: const response = await fetch("https://integrations.sh/api.json", { L1686: headers: { accept: "application/json" },

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/http/script-connections.tsView on unpkg · L1

dist/claude-sdk-session-9re1g7r2.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/claude-sdk-session-9re1g7r2.jsView on unpkg · L21

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/claude-sdk-session-9re1g7r2.jsView on unpkg · L21

dist/cli-ng97fjq7.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-ng97fjq7.jsView on unpkg

dist/http-w40q4w94.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/http-w40q4w94.jsView on unpkg · L578

dist/quickjs-r1pq2107.wasmView file

•path = dist/quickjs-r1pq2107.wasm kind = wasm_module sizeBytes = 637405 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/quickjs-r1pq2107.wasmView on unpkg

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-xtgtyafv.jsView file

•path = dist/cli-xtgtyafv.js kind = oversized_source_file sizeBytes = 9391014 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-xtgtyafv.jsView on unpkg

dist/cli-50eg13rj.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-50eg13rj.jsView on unpkg

dist/cli-5bfdm1ah.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-5bfdm1ah.jsView on unpkg

dist/cli-q51yprfq.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-q51yprfq.jsView on unpkg

dist/cli-zn2v3t8v.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-zn2v3t8v.jsView on unpkg

src/script-workflows/executor.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/script-workflows/executor.tsView on unpkg

dist/claude-k04qfvsv.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-k04qfvsv.jsView on unpkg

src/http/metrics.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/metrics.tsView on unpkg

src/http/pages-public.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/pages-public.tsView on unpkg

src/http/x.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/x.tsView on unpkg

dist/cli-bns5c8k9.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-bns5c8k9.jsView on unpkg

Source & flagged code

28 flagged

dist/cli-nvvfd8bq.jsView file

32352// node_modules/@earendil-works/pi-coding-agent/dist/core/exec.js L32353: import { spawn } from "node:child_process"; L32354: async function execCommand(command, args, cwd, options) {

High

Child Process

Package source references child process execution.

dist/cli-nvvfd8bq.jsView on unpkg · L32352

58formatToolCallWithArgs, L59: getPowerShellConfig, L60: getShellConfig,

High

Shell

Package source references shell execution.

dist/cli-nvvfd8bq.jsView on unpkg · L58

1152var require_util = __commonJS(function(exports, module) { L1153: var assert = __require("node:assert"); L1154: var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-nvvfd8bq.jsView on unpkg · L1152

dist/photon_rs-q3vet37k.jsView file

Lines 1176-1216javascript

1176 return ret;

1177};

1178var $__wbg_setheight_1761808c18403921 = function(arg0, arg1) {

1179 arg0.height = arg1 >>> 0;

1180};

1181

src/tests/page-proxy.test.tsView file

Lines 1-34typescript

1/**

2 * Integration tests for the page-session cookie flow:

3 * 1. Create a page (bearer-auth) → POST /api/pages

4 * 2. Launch it → POST /api/pages/:id/launch → captures Set-Cookie

5 * 3. Hit /@swarm/api/* with the cookie. The proxy injects the server bearer

6 * and verified page context while preserving the viewer's identity.

7 *

8 * Spawns the real `src/http.ts` server with API_KEY set so we exercise the

9 * full bearer + cookie + proxy chain, not the in-process handler in

10 * isolation.

dist/cli-0n4fasz0.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-0n4fasz0.jsView on unpkg · L11831

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-0n4fasz0.jsView on unpkg · L25

dist/index-fdk1t4d6.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index-fdk1t4d6.jsView on unpkg · L91092

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index-fdk1t4d6.jsView on unpkg · L91098

src/http/script-connections.tsView file

Lines 1-21typescript

1import type { IncomingMessage, ServerResponse } from "node:http";

2import { z } from "zod";

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/http/script-connections.tsView on unpkg · L1

3import { resolveHttpAuditUserId } from

dist/claude-sdk-session-9re1g7r2.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/claude-sdk-session-9re1g7r2.jsView on unpkg · L21

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/claude-sdk-session-9re1g7r2.jsView on unpkg · L21

dist/cli-ng97fjq7.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-ng97fjq7.jsView on unpkg

dist/http-w40q4w94.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/http-w40q4w94.jsView on unpkg · L578

dist/quickjs-r1pq2107.wasmView file

•path = dist/quickjs-r1pq2107.wasm kind = wasm_module sizeBytes = 637405 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/quickjs-r1pq2107.wasmView on unpkg

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-xtgtyafv.jsView file

•path = dist/cli-xtgtyafv.js kind = oversized_source_file sizeBytes = 9391014 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-xtgtyafv.jsView on unpkg

dist/cli-50eg13rj.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 28

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-50eg13rj.jsView on unpkg

dist/cli-5bfdm1ah.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-5bfdm1ah.jsView on unpkg

dist/cli-q51yprfq.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-q51yprfq.jsView on unpkg

dist/cli-zn2v3t8v.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-zn2v3t8v.jsView on unpkg

src/script-workflows/executor.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/script-workflows/executor.tsView on unpkg

dist/claude-k04qfvsv.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/claude-k04qfvsv.jsView on unpkg

src/http/metrics.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/metrics.tsView on unpkg

src/http/pages-public.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/pages-public.tsView on unpkg

src/http/x.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/http/x.tsView on unpkg

dist/cli-bns5c8k9.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-bns5c8k9.jsView on unpkg

@desplega.ai/agent-swarm@1.165.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code