registry / @desplega.ai/agent-swarm / 1.106.0

@desplega.ai/agent-swarm@1.106.0

Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 45 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 1,103 file(s), 23.9 MB of source, external domains: 10.0.0.1, 127.0.0.1, 169.254.169.254, 169.254.170.2, 172.16.0.1, 172.31.255.255, 172.32.0.1, 192.168.1.1, a.co, a.com, a.local, accounts.google.com, acme.example, agent-abc-123.swarm.example.com, agent-svc-test.swarm.example.com, agent-swarm-mcp.desplega.sh, agent-swarm.cloud, agent-swarm.cloud.attacker.com, agent-swarm.dev, agent-swarm.dev.attacker.com, ai-gateway.vercel.sh, ai-sdk.dev, aiplatform.googleapis.com, api.agent-swarm.cloud, api.agent-swarm.dev, api.agentmail.ai, api.agentmail.to, api.ant-ling.com, api.anthropic.com, api.atlassian.com, api.attio.com, api.cerebras.ai, api.cloudflare.com, api.deepseek.com, api.devin.ai, api.e2b.app, api.e2b.example, api.example-swarm.dev, api.example.com, api.example.test, api.fireworks.ai, api.github.com, api.groq.com, api.hubspot.com, api.individual.githubcopilot.com, api.kapso.ai, api.kimi.com, api.linear.app, api.minimax.io, api.minimaxi.com

Oversized source lightweight scan

dist/cli-84gyjn6h.js8.43 MB file, sampled 256 KB

FilesystemCryptoHighEntropyStrings

dist/cli-v90vvqt8.js2.79 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsEvalHighEntropyStringsUrlStringsraw.githubusercontent.com

dist/otel-impl-tddx9x81.js2.31 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsopentelemetry.io

dist/pi-mono-adapter-y037wnp4.js6.58 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsgithub.com

Source & flagged code

35 flagged

src/tests/task-supersede-resume.test.tsView file

Lines 545-585typescript

545 baseUrl = `http://localhost:${port}`;

546 });

547

548 afterAll(async () => {

549 if (server) {

550 await new Promise<void>((r) => server?.close(() => r()));

551 }

552 });

553

554 test("preserves the full parent task description", async () => {

555 mockSessionLogs = [];

556 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

557 expect(preamble).toBeTruthy();

558 expect(preamble).toContain(testTaskDescription);

559 expect(preamble).toContain("Resuming Interrupted Task");

560 });

561

562 test("scrubs secret-shaped values from session-log summaries", async () => {

563 // GitHub PAT-shaped token — matches a structural pattern in

564 // scrubSecrets (regardless of env state).

565 const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L565

566 mockSessionLogs = [

567 {

568 createdAt: new Date().toISOString(),

569 content: JSON.stringify({

570 type: "tool_use",

571 name: "Bash",

572 input: { command: `curl -H 'Authorization: ${fakeToken}' https://api` },

573 }),

574 },

575 ];

576

577 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

578 expect(preamble).toBeTruthy();

579 expect(preamble).not.toContain(fakeToken);

580 });

581

582 test("respects the 4000-token (16000-char) cap when over budget", async () => {

583 // Generate a lot of session logs to push past the cap.

584 mockSessionLogs = Array.from({ length: 200 }, (_, i) => ({

585 createdAt: new Date().toISOString(),

565patternName = github_pat severity = critical line = 565 matchedText = const fa...aa";

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L565

dist/cli-q44nxhwq.jsView file

Lines 898-938javascript

898 return (options.client ?? this._client).get({

899 url: "/session/{id}/children",

900 ...options

901 });

902 }

903 todo(options) {

904 return (options.client ?? this._client).

dist/cli-rp5kaak8.jsView file

11760} L11761: function combineURLs(baseURL, relativeURL) { L11762: return relativeURL ? baseURL.replace(/\/?\/$/, "") + "/" + relativeURL.replace(/^\/+/, "") : baseURL; ... L20866: try { L20867: data = node_fs_1.default.readFileSync(node_path_1.default.resolve("".concat(installationDir, "/app-latest"))); L20868: installation = JSON.parse(data.toString());

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-rp5kaak8.jsView on unpkg · L11760

25985site.name = fn.name; L25986: var deprecatedfn = new Function("fn", "log", "deprecate", "message", "site", `"use strict" L25987: ` + "return function (" + args + ") {" + `log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli-rp5kaak8.jsView on unpkg · L25985

32require_stream, L33: require_websocket, L34: require_websocket_server ... L161: L162: // node_modules/@slack/web-api/package.json L163: var require_package = __commonJS((exports, module) => { ... L219: eventemitter3: "^5.0.1", L220: "form-data": "^4.0.4", L221: "is-electron": "2.2.2", ... L10380: } else { L10381: dataBuffer = Buffer.concat([dataBuffer, Buffer.from(this._streams[i])]); L10382: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-rp5kaak8.jsView on unpkg · L32

dist/artifact-12d91qnq.jsView file

Lines 672-712javascript

672 jsdelivr: "dist/axios.min.js",

673 unpkg: "dist/axios.min.js",

674 typings: "./index.d.ts",

675 dependencies: {

676 "follow-redirects": "^1.14.0"

677 },

678 bundlesize: [

dist/cli-czkae1fp.jsView file

Lines 569-609javascript

569 return [value];

570 }

571 if (value === "") {

572 return [""];

573 }

574 const parts = value.split(delimiter);

575 if

dist/cli-anrn8brw.jsView file

Lines 33-73javascript

33} from "./cli-tghre7g6.js";

34import {

35 getApiKey

36} from "./cli-f14fvzag.js";

37import {

38 init_secret_scrubber,

39 scrubSecrets

40} from "./cli-3pp1362w.js";

41import {

dist/index-2qn2qndv.jsView file

15var supportsRequestInitExt = () => { L16: return typeof process === "object" && Number.parseInt(process?.versions?.node?.substring(0, 2)) >= 18 && process.versions.undici; L17: }; ... L59: const serializedBody = body === undefined ? undefined : bodySerializer(body, mergeHeaders(baseHeaders, headers, params.header)); L60: const finalHeaders = mergeHeaders(serializedBody === undefined || serializedBody instanceof FormData ? {} : { L61: "Content-Type": "application/json" ... L176: } L177: let error = await response.text(); L178: try { ... L1434: const dv = new DataView(new ArrayBuffer(8)); L1435: const ok = typeof BigInt === "function" && typeof dv.getBigInt64 === "function" && typeof dv.getBigUint64 === "function" && typeof dv.setBigInt64 === "function" && typeof dv.setBig... L1436: if (ok) {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index-2qn2qndv.jsView on unpkg · L15

plugin/skills/artifacts/examples/static-report.shView file

•path = [redacted]-report.sh kind = build_helper sizeBytes = 390 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/skills/artifacts/examples/static-report.shView on unpkg

dist/cli-84gyjn6h.jsView file

•path = dist/cli-84gyjn6h.js kind = oversized_source_file sizeBytes = 8836684 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-84gyjn6h.jsView on unpkg

src/tests/status.test.tsView file

343patternName = private_key_rsa severity = critical line = 343 matchedText = process......";

Critical

Secret Pattern

RSA private key in src/tests/status.test.ts

src/tests/status.test.tsView on unpkg · L343

src/tests/http-api-integration.test.tsView file

1618patternName = stripe_webhook_secret severity = high line = 1618 matchedText = const WE...cret

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1618

src/tests/launch-password-rejection.test.tsView file

76patternName = generic_password severity = medium line = 76 matchedText = password...sh",

Medium

Secret Pattern

Hardcoded password in src/tests/launch-password-rejection.test.ts

src/tests/launch-password-rejection.test.tsView on unpkg · L76

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51 matchedText = process....89";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53 matchedText = const ou...d");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102 matchedText = "ghp_poo...AB";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104 matchedText = const ou...0");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/pages-http.test.tsView file

133patternName = generic_password severity = medium line = 133 matchedText = const pa...-9";

Medium

Secret Pattern

Hardcoded password in src/tests/pages-http.test.ts

src/tests/pages-http.test.tsView on unpkg · L133

src/tests/create-page-tool.test.tsView file

180patternName = generic_password severity = medium line = 180 matchedText = password...me",

Medium

Secret Pattern

Hardcoded password in src/tests/create-page-tool.test.ts

src/tests/create-page-tool.test.tsView on unpkg · L180

src/tests/pages-public-authed-401.test.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = password...sh",

Medium

Secret Pattern

Hardcoded password in src/tests/pages-public-authed-401.test.ts

src/tests/pages-public-authed-401.test.tsView on unpkg · L92

Source & flagged code

35 flagged · loading source

src/tests/task-supersede-resume.test.tsView file

565patternName = github_pat severity = critical line = 565 matchedText = const fa...aa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L565

565patternName = github_pat severity = critical line = 565 matchedText = const fa...aa";

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L565

dist/cli-q44nxhwq.jsView file

918} L919: fork(options) { L920: return (options.client ?? this._client).post({

High

Child Process

Package source references child process execution.

dist/cli-q44nxhwq.jsView on unpkg · L918

dist/cli-rp5kaak8.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-rp5kaak8.jsView on unpkg · L11760

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli-rp5kaak8.jsView on unpkg · L25985

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-rp5kaak8.jsView on unpkg · L32

dist/artifact-12d91qnq.jsView file

692var buildURL = require_buildURL(); L693: var http = __require("http"); L694: var https = __require("https");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/artifact-12d91qnq.jsView on unpkg · L692

dist/cli-czkae1fp.jsView file

589}; L590: var uriEncode = (value) => encodeURIComponent(value).replace(/[!*'()]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`); L591: var endpointFunctions = { ... L2231: stream.on("error", (err) => { L2232: collector.end(); L2233: reject(err); ... L2368: throw new Error(`Cannot transform payload Blob to web stream. Please make sure the Blob.stream() is polyfilled. L2369: ` + "If you are using React Native, this API is not yet supported, see: https://react-native.canny.io/feature-requests/p/fetch-streaming-body"); L2370: } ... L5567: var getHomeDir = () => { L5568: const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${node_path.sep}` } = process.env; L5569: if (HOME)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-czkae1fp.jsView on unpkg · L589

dist/cli-anrn8brw.jsView file

53Cross-file remote execution chain: dist/cli-anrn8brw.js spawns dist/cli-50nss8e8.js; helper contains network access plus dynamic code execution. L53: import path from "path"; L54: import { spawn } from "child_process"; L55: import { statSync } from "fs"; ... L127: try { L128: parsed = JSON.parse(item); L129: } catch (error) { ... L269: } else { L270: for (const [key, value] of Object.entries(process.env)) { L271: if (value !== undefined) { ... L294: } L295: child.stdin.write(args.input); L296: child.stdin.end();

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli-anrn8brw.jsView on unpkg · L53

dist/index-2qn2qndv.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index-2qn2qndv.jsView on unpkg · L15

plugin/skills/artifacts/examples/static-report.shView file

•path = [redacted]-report.sh kind = build_helper sizeBytes = 390 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/skills/artifacts/examples/static-report.shView on unpkg

dist/cli-84gyjn6h.jsView file

•path = dist/cli-84gyjn6h.js kind = oversized_source_file sizeBytes = 8836684 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-84gyjn6h.jsView on unpkg

src/tests/status.test.tsView file

343patternName = private_key_rsa severity = critical line = 343 matchedText = process......";

Critical

Secret Pattern

RSA private key in src/tests/status.test.ts

src/tests/status.test.tsView on unpkg · L343

src/tests/http-api-integration.test.tsView file

1618patternName = stripe_webhook_secret severity = high line = 1618 matchedText = const WE...cret

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1618

src/tests/launch-password-rejection.test.tsView file

76patternName = generic_password severity = medium line = 76 matchedText = password...sh",

Medium

Secret Pattern

Hardcoded password in src/tests/launch-password-rejection.test.ts

src/tests/launch-password-rejection.test.tsView on unpkg · L76

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51 matchedText = process....89";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53 matchedText = const ou...d");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102 matchedText = "ghp_poo...AB";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104 matchedText = const ou...0");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

105patternName = github_pat severity = critical line = 105 matchedText = expect(o...0");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L105

110patternName = github_pat severity = critical line = 110 matchedText = process....89";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L110

114patternName = github_pat severity = critical line = 114 matchedText = "gh=ghp_...90";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L114

146patternName = github_fine_grained severity = critical line = 146 matchedText = const ou...f");

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L146

152patternName = github_pat severity = critical line = 152 matchedText = const ou...d");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L152

158patternName = github_oauth severity = critical line = 158 matchedText = const ou...d");

Critical

Secret Pattern

GitHub OAuth access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L158

163patternName = github_server_token severity = critical line = 163 matchedText = const ou...d");

Critical

Secret Pattern

GitHub server-to-server token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L163

197patternName = aws_access_key severity = critical line = 197 matchedText = const ou...g");

Critical

Secret Pattern

AWS access key ID in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L197

199patternName = aws_access_key severity = critical line = 199 matchedText = expect(o...E");

Critical

Secret Pattern

AWS access key ID in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L199

219patternName = github_pat severity = critical line = 219 matchedText = const ou...D");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L219

297patternName = github_pat severity = critical line = 297 matchedText = process....89";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L297

299patternName = github_pat severity = critical line = 299 matchedText = const on...9");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L299

204patternName = google_api_key severity = high line = 204 matchedText = const ou...l");

High

Secret Pattern

Google API key in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L204

src/tests/pages-http.test.tsView file

133patternName = generic_password severity = medium line = 133 matchedText = const pa...-9";

Medium

Secret Pattern

Hardcoded password in src/tests/pages-http.test.ts

src/tests/pages-http.test.tsView on unpkg · L133

src/tests/create-page-tool.test.tsView file

180patternName = generic_password severity = medium line = 180 matchedText = password...me",

Medium

Secret Pattern

Hardcoded password in src/tests/create-page-tool.test.ts

src/tests/create-page-tool.test.tsView on unpkg · L180

src/tests/pages-public-authed-401.test.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = password...sh",

Medium

Secret Pattern

Hardcoded password in src/tests/pages-public-authed-401.test.ts

src/tests/pages-public-authed-401.test.tsView on unpkg · L92

Findings

19 Critical9 High10 Medium7 Low

CriticalCritical Secretsrc/tests/task-supersede-resume.test.ts

CriticalSecret Patternsrc/tests/task-supersede-resume.test.ts

CriticalSecret Patternsrc/tests/status.test.ts

CriticalSecret Patternsrc/tests/secret-scrubber.test.ts

HighChild Processdist/cli-q44nxhwq.js

HighShell

HighCloud Metadata Accessdist/cli-czkae1fp.js

HighRemote Agent Bridgedist/cli-rp5kaak8.js

HighCross File Remote Execution Contextdist/cli-anrn8brw.js

HighBase64 Obscured Urldist/index-2qn2qndv.js

HighOversized Source Filedist/cli-84gyjn6h.js

HighSecret Patternsrc/tests/http-api-integration.test.ts

HighSecret Patternsrc/tests/secret-scrubber.test.ts

MediumDynamic Requiredist/artifact-12d91qnq.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperplugin/skills/artifacts/examples/static-report.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

MediumSecret Patternsrc/tests/launch-password-rejection.test.ts

MediumSecret Patternsrc/tests/pages-http.test.ts

MediumSecret Patternsrc/tests/create-page-tool.test.ts

MediumSecret Patternsrc/tests/pages-public-authed-401.test.ts

LowScripts Present

LowEvaldist/cli-rp5kaak8.js

LowWeak Cryptodist/cli-rp5kaak8.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

35 flagged

src/tests/task-supersede-resume.test.tsView file

Lines 545-585typescript

545 baseUrl = `http://localhost:${port}`;

546 });

547

548 afterAll(async () => {

549 if (server) {

550 await new Promise<void>((r) => server?.close(() => r()));

551 }

552 });

553

554 test("preserves the full parent task description", async () => {

555 mockSessionLogs = [];

556 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

557 expect(preamble).toBeTruthy();

558 expect(preamble).toContain(testTaskDescription);

559 expect(preamble).toContain("Resuming Interrupted Task");

560 });

561

562 test("scrubs secret-shaped values from session-log summaries", async () => {

563 // GitHub PAT-shaped token — matches a structural pattern in

564 // scrubSecrets (regardless of env state).

565 const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L565

566 mockSessionLogs = [

567 {

568 createdAt: new Date().toISOString(),

569 content: JSON.stringify({

570 type: "tool_use",

571 name: "Bash",

572 input: { command: `curl -H 'Authorization: ${fakeToken}' https://api` },

573 }),

574 },

575 ];

576

577 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

578 expect(preamble).toBeTruthy();

579 expect(preamble).not.toContain(fakeToken);

580 });

581

582 test("respects the 4000-token (16000-char) cap when over budget", async () => {

583 // Generate a lot of session logs to push past the cap.

584 mockSessionLogs = Array.from({ length: 200 }, (_, i) => ({

585 createdAt: new Date().toISOString(),

565patternName = github_pat severity = critical line = 565 matchedText = const fa...aa";

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L565

dist/cli-q44nxhwq.jsView file

Lines 898-938javascript

898 return (options.client ?? this._client).get({

899 url: "/session/{id}/children",

900 ...options

901 });

902 }

903 todo(options) {

904 return (options.client ?? this._client).

dist/cli-rp5kaak8.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli-rp5kaak8.jsView on unpkg · L11760

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli-rp5kaak8.jsView on unpkg · L25985

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli-rp5kaak8.jsView on unpkg · L32

dist/artifact-12d91qnq.jsView file

Lines 672-712javascript

672 jsdelivr: "dist/axios.min.js",

673 unpkg: "dist/axios.min.js",

674 typings: "./index.d.ts",

675 dependencies: {

676 "follow-redirects": "^1.14.0"

677 },

678 bundlesize: [

dist/cli-czkae1fp.jsView file

Lines 569-609javascript

569 return [value];

570 }

571 if (value === "") {

572 return [""];

573 }

574 const parts = value.split(delimiter);

575 if

dist/cli-anrn8brw.jsView file

Lines 33-73javascript

33} from "./cli-tghre7g6.js";

34import {

35 getApiKey

36} from "./cli-f14fvzag.js";

37import {

38 init_secret_scrubber,

39 scrubSecrets

40} from "./cli-3pp1362w.js";

41import {

dist/index-2qn2qndv.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/index-2qn2qndv.jsView on unpkg · L15

plugin/skills/artifacts/examples/static-report.shView file

•path = [redacted]-report.sh kind = build_helper sizeBytes = 390 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/skills/artifacts/examples/static-report.shView on unpkg

dist/cli-84gyjn6h.jsView file

•path = dist/cli-84gyjn6h.js kind = oversized_source_file sizeBytes = 8836684 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli-84gyjn6h.jsView on unpkg

src/tests/status.test.tsView file

343patternName = private_key_rsa severity = critical line = 343 matchedText = process......";

Critical

Secret Pattern

RSA private key in src/tests/status.test.ts

src/tests/status.test.tsView on unpkg · L343

src/tests/http-api-integration.test.tsView file

1618patternName = stripe_webhook_secret severity = high line = 1618 matchedText = const WE...cret

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1618

src/tests/launch-password-rejection.test.tsView file

76patternName = generic_password severity = medium line = 76 matchedText = password...sh",

Medium

Secret Pattern

Hardcoded password in src/tests/launch-password-rejection.test.ts

src/tests/launch-password-rejection.test.tsView on unpkg · L76

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51 matchedText = process....89";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53 matchedText = const ou...d");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102 matchedText = "ghp_poo...AB";

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104 matchedText = const ou...0");

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/pages-http.test.tsView file

133patternName = generic_password severity = medium line = 133 matchedText = const pa...-9";

Medium

Secret Pattern

Hardcoded password in src/tests/pages-http.test.ts

src/tests/pages-http.test.tsView on unpkg · L133

src/tests/create-page-tool.test.tsView file

180patternName = generic_password severity = medium line = 180 matchedText = password...me",

Medium

Secret Pattern

Hardcoded password in src/tests/create-page-tool.test.ts

src/tests/create-page-tool.test.tsView on unpkg · L180

src/tests/pages-public-authed-401.test.tsView file

92patternName = generic_password severity = medium line = 92 matchedText = password...sh",

Medium

Secret Pattern

Hardcoded password in src/tests/pages-public-authed-401.test.ts

src/tests/pages-public-authed-401.test.tsView on unpkg · L92