@desplega.ai/agent-swarm@1.142.0: Suspicious npm security report

Loading npm security reports…

@desplega.ai/agent-swarm@1.142.0: Suspicious npm security report | LPM Firewall

Source & flagged code

31 flagged

src/tests/task-supersede-resume.test.tsView file

Lines 628-668typescript

628 baseUrl = `http://localhost:${port}`;

629 });

630

631 afterAll(async () => {

632 if (server) {

633 await new Promise<void>((r) => server?.close(() => r()));

634 }

635 });

636

637 test("preserves the full parent task description", async () => {

638 mockSessionLogs = [];

639 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

640 expect(preamble).toBeTruthy();

641 expect(preamble).toContain(testTaskDescription);

642 expect(preamble).toContain("Resuming Interrupted Task");

643 });

644

645 test("scrubs secret-shaped values from session-log summaries", async () => {

646 // GitHub PAT-shaped token — matches a structural pattern in

647 // scrubSecrets (regardless of env state).

648 const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L648

649 mockSessionLogs = [

650 {

651 createdAt: new Date().toISOString(),

652 content: JSON.stringify({

653 type: "tool_use",

654 name: "Bash",

655 input: { command: `curl -H 'Authorization: ${fakeToken}' https://api` },

656 }),

657 },

658 ];

659

660 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

661 expect(preamble).toBeTruthy();

662 expect(preamble).not.toContain(fakeToken);

663 });

664

665 test("respects the 4000-token (16000-char) cap when over budget", async () => {

666 // Generate a lot of session logs to push past the cap.

667 mockSessionLogs = Array.from({ length: 200 }, (_, i) => ({

668 createdAt: new Date().toISOString(),

648patternName = github_pat severity = critical line = 648

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L648

dist/cli-s9gpxh9q.jsView file

6961var executable_response_1 = require_executable_response(); L6962: var childProcess = __require("child_process"); L6963: var fs = __require("fs");

High

Child Process

Package source references child process execution.

dist/cli-s9gpxh9q.jsView on unpkg · L6961

dist/cli-thdvmrm6.jsView file

Lines 1514-1554javascript

1514 resolve(v);

1515 } catch {

1516 if (settled)

1517 return;

1518 settled = true;

1519 clearTimeout(timer);

dist/cli-c4eeb5q2.jsView file

Lines 1-25javascript

1import {

2 lazyApi

3} from "./cli-rgvp6r2x.js";

5// node_modules/@earendil-works/pi-ai/dist/api/bedrock-converse-stream.lazy.js

6var __rewriteRelativeImportExtension = function(path, preserveJsx

dist/cli-tbtxpj2k.jsView file

1703var names = { L1704: data: new codegen_1.Name("data"), L1705: valCxt: new codegen_1.Name("valCxt"), ... L2690: id = normalizeId(id); L2691: return resolver.resolve(baseId, id); L2692: } ... L3535: for (i = 0;i < input.length; i++) { L3536: code = input[i].charCodeAt(0); L3537: if (code === 48) { ... L18628: var appId = null; L18629: var privateKey = null; L18630: var tokenCache = new Map;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli-tbtxpj2k.jsView on unpkg · L1703

dist/http-x6fy2qbf.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/http-x6fy2qbf.js: AssetKeyAuthorizationError, deriveApiBaseUrl, [redacted], buildAuthorizationUrl, deleteAuthorizationById, deleteAuthorizationsForApp, exchangeAuthorizationCode, [redacted],

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/http-x6fy2qbf.jsView on unpkg

dist/index-yqweff5n.jsView file

Lines 20-60javascript

20 req.destroy();

21 });

22 req.on("timeout", () => {

23 reject(new config.ProviderError("TimeoutError from instance metadata service"));

24 req.destroy

dist/pi-mono-adapter-ncpmv3qw.jsView file

156Cross-file remote execution chain: dist/pi-mono-adapter-ncpmv3qw.js spawns dist/cli-0v7jxbvz.js; helper contains network access plus dynamic code execution. L156: var RETURN_FALSE = () => false; L157: var sanitizeRange = (range) => range.replace(REGEX_REGEXP_RANGE, (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY); L158: var cleanRangeBackSlash = (slashes) => { ... L446: }; L447: if (typeof process !== "undefined" && process.platform === "win32") { L448: setupWindows(); ... L918: const { findPnpApi: e3 } = l3; L919: return e3 && e3(process.cwd()); L920: }, "getPnpApi"), re = r((e3, t3, i3, n2) => { ... L937: return E3 = a.join(e3, "..", E3), n2 == null || n2.set(c3, E3), E3; L938: }, "resolveFromPackageJsonPath"), ne = "package.json", ae2 = "tsconfig.json", oe2 =

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pi-mono-adapter-ncpmv3qw.jsView on unpkg · L156

src/http/script-connections.tsView file

Lines 1-21typescript

1import type { IncomingMessage, ServerResponse } from "node:http";

2import { z } from "zod";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/http/script-connections.tsView on unpkg · L1

3import { resolveHttpAuditUserId } from

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-0afy4jqg.jsView file

•path = dist/cli-0afy4jqg.js kind = oversized_source_file sizeBytes = 8941465 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-0afy4jqg.jsView on unpkg

dist/cli-1cwhyvta.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-1cwhyvta.jsView on unpkg

dist/cli-qmsts4ef.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @desplega.ai/agent-swarm@1.141.0 matchedIdentity = npm:[redacted]:1.141.0 similarity = 0.842 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-qmsts4ef.jsView on unpkg

src/tests/http-api-integration.test.tsView file

1881patternName = stripe_webhook_secret severity = high line = 1881

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1881

src/tests/queue-stall-alarm.test.tsView file

216patternName = github_pat severity = critical line = 216

Critical

Secret Pattern

GitHub personal access token in src/tests/queue-stall-alarm.test.ts

src/tests/queue-stall-alarm.test.tsView on unpkg · L216

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

src/tests/e2e-redact.test.tsView file

10patternName = github_pat severity = critical line = 10

Critical

Secret Pattern

GitHub personal access token in src/tests/e2e-redact.test.ts

src/tests/e2e-redact.test.tsView on unpkg · L10

Source & flagged code

31 flagged · loading source

src/tests/task-supersede-resume.test.tsView file

648patternName = github_pat severity = critical line = 648

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L648

648patternName = github_pat severity = critical line = 648

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L648

dist/cli-s9gpxh9q.jsView file

6961var executable_response_1 = require_executable_response(); L6962: var childProcess = __require("child_process"); L6963: var fs = __require("fs");

High

Child Process

Package source references child process execution.

dist/cli-s9gpxh9q.jsView on unpkg · L6961

dist/cli-thdvmrm6.jsView file

1534try { L1535: fn = new Function(...PARAM_SHADOW_KEYS, "payload", `${BODY_SHADOW_PREAMBLE} return (${filter})(payload);`); L1536: } catch (err) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli-thdvmrm6.jsView on unpkg · L1534

dist/cli-c4eeb5q2.jsView file

15const runtimeSpecifier = import.meta.url.endsWith(".js") ? specifier.replace(/\.ts$/, ".js") : specifier; L16: return import(__rewriteRelativeImportExtension(runtimeSpecifier)); L17: };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-c4eeb5q2.jsView on unpkg · L15

dist/cli-tbtxpj2k.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli-tbtxpj2k.jsView on unpkg · L1703

dist/http-x6fy2qbf.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/http-x6fy2qbf.jsView on unpkg

dist/index-yqweff5n.jsView file

40}); L41: req.end(); L42: }); ... L59: const requestOptions = await getCmdsUri({ logger: init.logger }); L60: const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions)); L61: if (!isImdsCredentials(credsResponse)) { ... L68: }, requestFromEcsImds = async (timeout, options) => { L69: if (process.env[ENV_CMDS_AUTH_TOKEN]) { L70: options.headers = { ... L119: } L120: }, STATIC_STABILITY_REFRESH_INTERVAL_SECONDS, STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS, STATIC_STABILITY_DOC_URL = "https://docs.aws.amazon.com/sdkref/latest/guide/f... L121: const refreshInterval = STATIC_STABILITY_REFRESH_INTERVAL_SECONDS + Math.floor(Math.random() * STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS);

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index-yqweff5n.jsView on unpkg · L40

dist/pi-mono-adapter-ncpmv3qw.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pi-mono-adapter-ncpmv3qw.jsView on unpkg · L156

src/http/script-connections.tsView file

1Trigger-reachable chain: manifest.module -> src/http.ts -> src/http/index.ts -> src/http/script-connections.ts L1: import type { IncomingMessage, ServerResponse } from "node:http"; L2: import { z } from "zod"; ... L304: .optional(), L305: hasBody: z.boolean().optional(), L306: successStatus: z.string().optional(), ... L1178: try { L1179: const runtime = JSON.parse(connection.generatedRuntimeJson) as { L1180: operations?: unknown; ... L1676: try { L1677: const response = await fetch("https://integrations.sh/api.json", { L1678: headers: { accept: "application/json" },

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/http/script-connections.tsView on unpkg · L1

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-0afy4jqg.jsView file

•path = dist/cli-0afy4jqg.js kind = oversized_source_file sizeBytes = 8941465 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-0afy4jqg.jsView on unpkg

dist/cli-1cwhyvta.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-1cwhyvta.jsView on unpkg

dist/cli-qmsts4ef.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-qmsts4ef.jsView on unpkg

src/tests/http-api-integration.test.tsView file

1881patternName = stripe_webhook_secret severity = high line = 1881

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1881

src/tests/queue-stall-alarm.test.tsView file

216patternName = github_pat severity = critical line = 216

Critical

Secret Pattern

GitHub personal access token in src/tests/queue-stall-alarm.test.ts

src/tests/queue-stall-alarm.test.tsView on unpkg · L216

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

src/tests/e2e-redact.test.tsView file

10patternName = github_pat severity = critical line = 10

Critical

Secret Pattern

GitHub personal access token in src/tests/e2e-redact.test.ts

src/tests/e2e-redact.test.tsView on unpkg · L10

Source & flagged code

31 flagged

src/tests/task-supersede-resume.test.tsView file

Lines 628-668typescript

628 baseUrl = `http://localhost:${port}`;

629 });

630

631 afterAll(async () => {

632 if (server) {

633 await new Promise<void>((r) => server?.close(() => r()));

634 }

635 });

636

637 test("preserves the full parent task description", async () => {

638 mockSessionLogs = [];

639 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

640 expect(preamble).toBeTruthy();

641 expect(preamble).toContain(testTaskDescription);

642 expect(preamble).toContain("Resuming Interrupted Task");

643 });

644

645 test("scrubs secret-shaped values from session-log summaries", async () => {

646 // GitHub PAT-shaped token — matches a structural pattern in

647 // scrubSecrets (regardless of env state).

648 const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L648

649 mockSessionLogs = [

650 {

651 createdAt: new Date().toISOString(),

652 content: JSON.stringify({

653 type: "tool_use",

654 name: "Bash",

655 input: { command: `curl -H 'Authorization: ${fakeToken}' https://api` },

656 }),

657 },

658 ];

659

660 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

661 expect(preamble).toBeTruthy();

662 expect(preamble).not.toContain(fakeToken);

663 });

664

665 test("respects the 4000-token (16000-char) cap when over budget", async () => {

666 // Generate a lot of session logs to push past the cap.

667 mockSessionLogs = Array.from({ length: 200 }, (_, i) => ({

668 createdAt: new Date().toISOString(),

648patternName = github_pat severity = critical line = 648

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L648

dist/cli-s9gpxh9q.jsView file

6961var executable_response_1 = require_executable_response(); L6962: var childProcess = __require("child_process"); L6963: var fs = __require("fs");

High

Child Process

Package source references child process execution.

dist/cli-s9gpxh9q.jsView on unpkg · L6961

dist/cli-thdvmrm6.jsView file

Lines 1514-1554javascript

1514 resolve(v);

1515 } catch {

1516 if (settled)

1517 return;

1518 settled = true;

1519 clearTimeout(timer);

dist/cli-c4eeb5q2.jsView file

Lines 1-25javascript

1import {

2 lazyApi

3} from "./cli-rgvp6r2x.js";

5// node_modules/@earendil-works/pi-ai/dist/api/bedrock-converse-stream.lazy.js

6var __rewriteRelativeImportExtension = function(path, preserveJsx

dist/cli-tbtxpj2k.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli-tbtxpj2k.jsView on unpkg · L1703

dist/http-x6fy2qbf.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/http-x6fy2qbf.jsView on unpkg

dist/index-yqweff5n.jsView file

Lines 20-60javascript

20 req.destroy();

21 });

22 req.on("timeout", () => {

23 reject(new config.ProviderError("TimeoutError from instance metadata service"));

24 req.destroy

dist/pi-mono-adapter-ncpmv3qw.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pi-mono-adapter-ncpmv3qw.jsView on unpkg · L156

src/http/script-connections.tsView file

Lines 1-21typescript

1import type { IncomingMessage, ServerResponse } from "node:http";

2import { z } from "zod";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/http/script-connections.tsView on unpkg · L1

3import { resolveHttpAuditUserId } from

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-0afy4jqg.jsView file

•path = dist/cli-0afy4jqg.js kind = oversized_source_file sizeBytes = 8941465 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-0afy4jqg.jsView on unpkg

dist/cli-1cwhyvta.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-1cwhyvta.jsView on unpkg

dist/cli-qmsts4ef.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli-qmsts4ef.jsView on unpkg

src/tests/http-api-integration.test.tsView file

1881patternName = stripe_webhook_secret severity = high line = 1881

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1881

src/tests/queue-stall-alarm.test.tsView file

216patternName = github_pat severity = critical line = 216

Critical

Secret Pattern

GitHub personal access token in src/tests/queue-stall-alarm.test.ts

src/tests/queue-stall-alarm.test.tsView on unpkg · L216

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

src/tests/e2e-redact.test.tsView file

10patternName = github_pat severity = critical line = 10

Critical

Secret Pattern

GitHub personal access token in src/tests/e2e-redact.test.ts

src/tests/e2e-redact.test.tsView on unpkg · L10

@desplega.ai/agent-swarm@1.142.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code