@desplega.ai/agent-swarm@1.145.0: Suspicious npm security report

Loading npm security reports…

@desplega.ai/agent-swarm@1.145.0: Suspicious npm security report | LPM Firewall

Source & flagged code

39 flagged

src/tests/task-supersede-resume.test.tsView file

Lines 628-668typescript

628 baseUrl = `http://localhost:${port}`;

629 });

630

631 afterAll(async () => {

632 if (server) {

633 await new Promise<void>((r) => server?.close(() => r()));

634 }

635 });

636

637 test("preserves the full parent task description", async () => {

638 mockSessionLogs = [];

639 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

640 expect(preamble).toBeTruthy();

641 expect(preamble).toContain(testTaskDescription);

642 expect(preamble).toContain("Resuming Interrupted Task");

643 });

644

645 test("scrubs secret-shaped values from session-log summaries", async () => {

646 // GitHub PAT-shaped token — matches a structural pattern in

647 // scrubSecrets (regardless of env state).

648 const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L648

649 mockSessionLogs = [

650 {

651 createdAt: new Date().toISOString(),

652 content: JSON.stringify({

653 type: "tool_use",

654 name: "Bash",

655 input: { command: `curl -H 'Authorization: ${fakeToken}' https://api` },

656 }),

657 },

658 ];

659

660 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

661 expect(preamble).toBeTruthy();

662 expect(preamble).not.toContain(fakeToken);

663 });

664

665 test("respects the 4000-token (16000-char) cap when over budget", async () => {

666 // Generate a lot of session logs to push past the cap.

667 mockSessionLogs = Array.from({ length: 200 }, (_, i) => ({

668 createdAt: new Date().toISOString(),

648patternName = github_pat severity = critical line = 648

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L648

dist/cli-rvqz34y5.jsView file

Lines 113-153javascript

113 env: opts.env ?? process.env,

114 apiUrl: opts.apiUrl,

115 apiKey: opts.apiKey,

116 callerTag: opts.callerTag

117 });

118 }

119 if (

dist/photon_rs-q3vet37k.jsView file

Lines 1176-1216javascript

1176 return ret;

1177};

1178var $__wbg_setheight_1761808c18403921 = function(arg0, arg1) {

1179 arg0.height = arg1 >>> 0;

dist/cli-c4eeb5q2.jsView file

Lines 1-25javascript

1import {

2 lazyApi

3} from "./cli-rgvp6r2x.js";

5// node_modules/@earendil-works/pi-ai/dist/api/bedrock-converse-stream.lazy.js

6var __rewriteRelativeImportExtension = function(path, preserveJsx

src/tests/page-proxy.test.tsView file

Lines 1-34typescript

1/**

2 * Integration tests for the page-session cookie flow:

3 * 1. Create a page (bearer-auth) → POST /api/pages

4 * 2. Launch it → POST /api/pages/:id/launch → captures Set-Cookie

5 * 3. Hit /@swarm/api/* with the cookie. The proxy injects the server bearer

6 * and verified page context while preserving the viewer's identity.

7 *

8 * Spawns the real `src/http.ts` server with API_KEY set so we exercise the

9 * full bearer + cookie + proxy chain, not the in-process handler in

10 * isolation.

dist/http-r4kq5g8d.jsView file

908import { L909: import_websocket, L910: import_websocket_server ... L1066: end: () => { L1067: bestEffortTelemetry("span.end", () => span.end()); L1068: } ... L1084: } L1085: function readPositiveIntEnv(key, env = process.env) { L1086: const raw = env[key]?.trim(); ... L1891: return; L1892: const value = JSON.parse(raw); L1893: if (typeof value.ack === "number") {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/http-r4kq5g8d.jsView on unpkg · L908

908Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/http-r4kq5g8d.js L908: import { L909: import_websocket, L910: import_websocket_server ... L1066: end: () => { L1067: bestEffortTelemetry("span.end", () => span.end()); L1068: } ... L1084: } L1085: function readPositiveIntEnv(key, env = process.env) { L1086: const raw = env[key]?.trim(); ... L1891: return; L1892: const value = JSON.parse(raw); L1893: if (typeof value.ack === "number") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/http-r4kq5g8d.jsView on unpkg · L908

15093// src/realtime/browser.generated.txt L15094: var browser_generated_default = "var Tp=Object.defineProperty;var Ap=(e)=>e;function Op(e,t){this[e]=Ap.bind(null,t)}var Zp=(e,t)=>{for(var r in t)Tp(e,r,{get:t[r],enumerable:!0,co... L15095:

High

dist/cli-gxnzc6wh.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli-gxnzc6wh.js: const codexPath = options.codexPath ?? resolveCodexPath(options.env.PATH); await readLines(this.proc.stdout, MAX_STDOUT_LINE_LENGTH, (line) => this.handleLine(line)); await readLines(this.proc.stderr, MAX_STDERR_LINE_LENGTH, (line) => { async function readLines(stream, maxLineLength, onLine) { description: "Fast-mode variant of [Opus 4.8](/anthropic/claude-opus-4.8) - identical capabilities with higher output speed at 2x pricing relative to regular Opus 4.8. Learn more i... description: "Fast-mode variant of [Opus 5](/anthropic/claude-opus-5) - identical capabilities with higher output speed at 2x pricing relative

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-gxnzc6wh.jsView on unpkg

•path = dist/cli-gxnzc6wh.js kind = oversized_source_file sizeBytes = 8196755 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-gxnzc6wh.jsView on unpkg

dist/cli-81r683bv.jsView file

9import { L10: import_websocket L11: } from "./cli-76yrvwsa.js"; ... L112: L113: // node_modules/gaxios/package.json L114: var require_package = __commonJS(function(exports, module) { ... L328: case "json": L329: return JSON.parse(JSON.stringify(data)); L330: case "arraybuffer": ... L358: return; L359: } else if (obj instanceof FormData || obj instanceof URLSearchParams || "forEach" in obj && "set" in obj) { L360: obj.forEach((_, key) => {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-81r683bv.jsView on unpkg · L9

dist/claude-sdk-session-swt80j9z.jsView file

9Cross-file remote execution chain: dist/claude-sdk-session-swt80j9z.js spawns dist/cli-1ebpar1q.js; helper contains network access plus dynamic code execution. L9: SessionErrorTracker, L10: parseStderrForErrors, L11: trackErrorFromJson ... L69: import * as gn from "node:path"; L70: import { execFile as Due } from "node:child_process"; L71: import { promisify as Lue } from "node:util"; ... L85: import aEe from "stream"; L86: import hEe from "http"; L87: import gEe from "https"; ... L298: if (r === "m") L299: throw TypeError("Private method is not writable"); L300: if (r === "a" && !o)

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/claude-sdk-session-swt80j9z.jsView on unpkg · L9

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-5bfdm1ah.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-5bfdm1ah.js#virtual:normalized:round1View on unpkg

dist/e2b-6hb103d8.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @desplega.ai/agent-swarm@1.144.0 matchedIdentity = npm:[redacted]:1.144.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/e2b-6hb103d8.jsView on unpkg

src/tests/acp-adapter.test.tsView file

210patternName = github_pat severity = critical line = 210

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L210

345patternName = github_pat severity = critical line = 345

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L345

462patternName = github_pat severity = critical line = 462

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L462

src/tests/http-api-integration.test.tsView file

1881patternName = stripe_webhook_secret severity = high line = 1881

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1881

src/tests/slack-reaction-config.test.tsView file

323patternName = github_fine_grained severity = critical line = 323

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L323

342patternName = github_fine_grained severity = critical line = 342

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L342

364patternName = github_fine_grained severity = critical line = 364

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L364

383patternName = github_fine_grained severity = critical line = 383

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/queue-stall-alarm.test.tsView file

216patternName = github_pat severity = critical line = 216

Critical

Secret Pattern

GitHub personal access token in src/tests/queue-stall-alarm.test.ts

src/tests/queue-stall-alarm.test.tsView on unpkg · L216

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

Source & flagged code

39 flagged · loading source

src/tests/task-supersede-resume.test.tsView file

648patternName = github_pat severity = critical line = 648

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L648

648patternName = github_pat severity = critical line = 648

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L648

dist/cli-rvqz34y5.jsView file

133try { L134: const raw = await spawn(`${opts.systemPrompt} L135:

High

Child Process

Package source references child process execution.

dist/cli-rvqz34y5.jsView on unpkg · L133

dist/photon_rs-q3vet37k.jsView file

1196var $__wbg_newnoargs_e643855c6572a4a8 = function(arg0, arg1) { L1197: const ret = new Function(getStringFromWasm0(arg0, arg1)); L1198: return ret;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/photon_rs-q3vet37k.jsView on unpkg · L1196

dist/cli-c4eeb5q2.jsView file

15const runtimeSpecifier = import.meta.url.endsWith(".js") ? specifier.replace(/\.ts$/, ".js") : specifier; L16: return import(__rewriteRelativeImportExtension(runtimeSpecifier)); L17: };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli-c4eeb5q2.jsView on unpkg · L15

src/tests/page-proxy.test.tsView file

14import { unlink } from "node:fs/promises"; L15: import net from "node:net"; L16: import { runInNewContext } from "node:vm"; ... L39: }, L40: body: JSON.stringify({ L41: name, ... L49: if (res.status !== 201 && res.status !== 200) { L50: throw new Error(`Failed to register agent: ${res.status} ${await res.text()}`); L51: } ... L65: // signPageSession() in-process validate at the proxy. L66: process.env.PAGE_SESSION_SECRET = PAGE_SECRET; L67:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

src/tests/page-proxy.test.tsView on unpkg · L14

dist/http-r4kq5g8d.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/http-r4kq5g8d.jsView on unpkg · L908

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/http-r4kq5g8d.jsView on unpkg · L908

High

dist/cli-gxnzc6wh.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-gxnzc6wh.jsView on unpkg

•path = dist/cli-gxnzc6wh.js kind = oversized_source_file sizeBytes = 8196755 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-gxnzc6wh.jsView on unpkg

dist/cli-81r683bv.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-81r683bv.jsView on unpkg · L9

dist/claude-sdk-session-swt80j9z.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/claude-sdk-session-swt80j9z.jsView on unpkg · L9

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-5bfdm1ah.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-5bfdm1ah.js#virtual:normalized:round1View on unpkg

dist/e2b-6hb103d8.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/e2b-6hb103d8.jsView on unpkg

src/tests/acp-adapter.test.tsView file

210patternName = github_pat severity = critical line = 210

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L210

345patternName = github_pat severity = critical line = 345

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L345

462patternName = github_pat severity = critical line = 462

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L462

src/tests/http-api-integration.test.tsView file

1881patternName = stripe_webhook_secret severity = high line = 1881

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1881

src/tests/slack-reaction-config.test.tsView file

323patternName = github_fine_grained severity = critical line = 323

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L323

342patternName = github_fine_grained severity = critical line = 342

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L342

364patternName = github_fine_grained severity = critical line = 364

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L364

383patternName = github_fine_grained severity = critical line = 383

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/queue-stall-alarm.test.tsView file

216patternName = github_pat severity = critical line = 216

Critical

Secret Pattern

GitHub personal access token in src/tests/queue-stall-alarm.test.ts

src/tests/queue-stall-alarm.test.tsView on unpkg · L216

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

Findings

27 Critical8 High9 Medium6 Low

CriticalCritical Secretsrc/tests/task-supersede-resume.test.ts

CriticalHardcoded Runtime Data Exfiltrationdist/http-r4kq5g8d.js

CriticalTrigger Reachable Dangerous Capabilitydist/http-r4kq5g8d.js

CriticalPrevious Version Dangerous Deltadist/e2b-6hb103d8.js

CriticalSecret Patternsrc/tests/task-supersede-resume.test.ts

CriticalSecret Patternsrc/tests/acp-adapter.test.ts

CriticalSecret Patternsrc/tests/slack-reaction-config.test.ts

CriticalSecret Patternsrc/tests/queue-stall-alarm.test.ts

CriticalSecret Patternsrc/tests/secret-scrubber.test.ts

HighChild Processdist/cli-rvqz34y5.js

HighShell

HighSame File Env Network Executiondist/http-r4kq5g8d.js

HighCredential Redirect Persistencedist/cli-gxnzc6wh.js

HighCloud Metadata Accessdist/cli-81r683bv.js

HighCross File Remote Execution Contextdist/claude-sdk-session-swt80j9z.js

HighSemantic Analysis Limiteddist/cli-5bfdm1ah.js#virtual:normalized:round1

HighSecret Patternsrc/tests/http-api-integration.test.ts

MediumDynamic Requiredist/cli-c4eeb5q2.js

MediumUnsafe Vm Contextsrc/tests/page-proxy.test.ts

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helpertemplates/official/ux-principles/start-up.sh

MediumOversized Source Filedist/cli-gxnzc6wh.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/photon_rs-q3vet37k.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

39 flagged

src/tests/task-supersede-resume.test.tsView file

Lines 628-668typescript

628 baseUrl = `http://localhost:${port}`;

629 });

630

631 afterAll(async () => {

632 if (server) {

633 await new Promise<void>((r) => server?.close(() => r()));

634 }

635 });

636

637 test("preserves the full parent task description", async () => {

638 mockSessionLogs = [];

639 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

640 expect(preamble).toBeTruthy();

641 expect(preamble).toContain(testTaskDescription);

642 expect(preamble).toContain("Resuming Interrupted Task");

643 });

644

645 test("scrubs secret-shaped values from session-log summaries", async () => {

646 // GitHub PAT-shaped token — matches a structural pattern in

647 // scrubSecrets (regardless of env state).

648 const fakeToken = "ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/tests/task-supersede-resume.test.tsView on unpkg · L648

649 mockSessionLogs = [

650 {

651 createdAt: new Date().toISOString(),

652 content: JSON.stringify({

653 type: "tool_use",

654 name: "Bash",

655 input: { command: `curl -H 'Authorization: ${fakeToken}' https://api` },

656 }),

657 },

658 ];

659

660 const preamble = await buildResumeContextPreamble(baseUrl, "", testTaskId);

661 expect(preamble).toBeTruthy();

662 expect(preamble).not.toContain(fakeToken);

663 });

664

665 test("respects the 4000-token (16000-char) cap when over budget", async () => {

666 // Generate a lot of session logs to push past the cap.

667 mockSessionLogs = Array.from({ length: 200 }, (_, i) => ({

668 createdAt: new Date().toISOString(),

648patternName = github_pat severity = critical line = 648

Critical

Secret Pattern

GitHub personal access token in src/tests/task-supersede-resume.test.ts

src/tests/task-supersede-resume.test.tsView on unpkg · L648

dist/cli-rvqz34y5.jsView file

Lines 113-153javascript

113 env: opts.env ?? process.env,

114 apiUrl: opts.apiUrl,

115 apiKey: opts.apiKey,

116 callerTag: opts.callerTag

117 });

118 }

119 if (

dist/photon_rs-q3vet37k.jsView file

Lines 1176-1216javascript

1176 return ret;

1177};

1178var $__wbg_setheight_1761808c18403921 = function(arg0, arg1) {

1179 arg0.height = arg1 >>> 0;

dist/cli-c4eeb5q2.jsView file

Lines 1-25javascript

1import {

2 lazyApi

3} from "./cli-rgvp6r2x.js";

5// node_modules/@earendil-works/pi-ai/dist/api/bedrock-converse-stream.lazy.js

6var __rewriteRelativeImportExtension = function(path, preserveJsx

src/tests/page-proxy.test.tsView file

Lines 1-34typescript

1/**

2 * Integration tests for the page-session cookie flow:

3 * 1. Create a page (bearer-auth) → POST /api/pages

4 * 2. Launch it → POST /api/pages/:id/launch → captures Set-Cookie

5 * 3. Hit /@swarm/api/* with the cookie. The proxy injects the server bearer

6 * and verified page context while preserving the viewer's identity.

7 *

8 * Spawns the real `src/http.ts` server with API_KEY set so we exercise the

9 * full bearer + cookie + proxy chain, not the in-process handler in

10 * isolation.

dist/http-r4kq5g8d.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/http-r4kq5g8d.jsView on unpkg · L908

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/http-r4kq5g8d.jsView on unpkg · L908

High

dist/cli-gxnzc6wh.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli-gxnzc6wh.jsView on unpkg

•path = dist/cli-gxnzc6wh.js kind = oversized_source_file sizeBytes = 8196755 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli-gxnzc6wh.jsView on unpkg

dist/cli-81r683bv.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli-81r683bv.jsView on unpkg · L9

dist/claude-sdk-session-swt80j9z.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/claude-sdk-session-swt80j9z.jsView on unpkg · L9

templates/official/ux-principles/start-up.shView file

•path = templates/official/ux-principles/start-up.sh kind = build_helper sizeBytes = 582 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/official/ux-principles/start-up.shView on unpkg

dist/cli-5bfdm1ah.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 22

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-5bfdm1ah.js#virtual:normalized:round1View on unpkg

dist/e2b-6hb103d8.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/e2b-6hb103d8.jsView on unpkg

src/tests/acp-adapter.test.tsView file

210patternName = github_pat severity = critical line = 210

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L210

345patternName = github_pat severity = critical line = 345

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L345

462patternName = github_pat severity = critical line = 462

Critical

Secret Pattern

GitHub personal access token in src/tests/acp-adapter.test.ts

src/tests/acp-adapter.test.tsView on unpkg · L462

src/tests/http-api-integration.test.tsView file

1881patternName = stripe_webhook_secret severity = high line = 1881

High

Secret Pattern

Stripe webhook signing secret in src/tests/http-api-integration.test.ts

src/tests/http-api-integration.test.tsView on unpkg · L1881

src/tests/slack-reaction-config.test.tsView file

323patternName = github_fine_grained severity = critical line = 323

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L323

342patternName = github_fine_grained severity = critical line = 342

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L342

364patternName = github_fine_grained severity = critical line = 364

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/slack-reaction-config.test.tsView on unpkg · L364

383patternName = github_fine_grained severity = critical line = 383

Critical

Secret Pattern

GitHub fine-grained PAT in src/tests/slack-reaction-config.test.ts

src/tests/queue-stall-alarm.test.tsView file

216patternName = github_pat severity = critical line = 216

Critical

Secret Pattern

GitHub personal access token in src/tests/queue-stall-alarm.test.ts

src/tests/queue-stall-alarm.test.tsView on unpkg · L216

src/tests/secret-scrubber.test.tsView file

51patternName = github_pat severity = critical line = 51

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L51

53patternName = github_pat severity = critical line = 53

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L53

102patternName = github_pat severity = critical line = 102

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L102

104patternName = github_pat severity = critical line = 104

Critical

Secret Pattern

GitHub personal access token in src/tests/secret-scrubber.test.ts

src/tests/secret-scrubber.test.tsView on unpkg · L104

@desplega.ai/agent-swarm@1.145.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code