@dev-anywhere/relay@0.5.0

Relay server for DEV Anywhere — bridges local AI CLI proxies to remote web clients via WebSocket.

Static Scan Results

scanned 18h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 2.00 MB of source, external domains: auto.example.com, bellard.org, bit.ly, dashscope-intl.aliyuncs.com, dashscope.aliyuncs.com, example.com, github.com, json-schema.org, placehold.co, radix-ui.com, react.dev, www.w3.org

Source & flagged code

3 flagged

assets/web/assets/fvad-DYxbW2my.wasmView file

•path = assets/web/assets/fvad-DYxbW2my.wasm kind = wasm_module sizeBytes = 20569 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

assets/web/assets/fvad-DYxbW2my.wasmView on unpkg

assets/web/favicon.icoView file

•path = assets/web/favicon.ico kind = high_entropy_blob sizeBytes = 7926 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/web/favicon.icoView on unpkg

assets/web/workbox-10a3128e.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dev-anywhere/relay@0.4.84 matchedIdentity = npm:QGRldi1hbnl3aGVyZS9yZWxheQ:0.4.84 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Source & flagged code

3 flagged · loading source

assets/web/assets/fvad-DYxbW2my.wasm

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code