registry / @duckmind/dm-darwin-arm64 / 0.41.2

@duckmind/dm-darwin-arm64@0.41.2

DuckMind (dm) binary payload for darwin arm64

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 229 file(s), 1.77 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, chatgpt.com, claude.ai, clerk.consensus.app, cloud.gitlab.com, consensus.app, console.anthropic.com, copilot.microsoft.com, distro.ibiblio.org, doi.org, example.com, gemini.google.com, github.com, gitlab.com, logically.app, openrouter.ai, raw.githubusercontent.com, www.google.com, www.perplexity.ai, www.semanticscholar.org

Source & flagged code

7 flagged

extensions/dm-subagents/src/service-adapter.tsView file

Lines 1-36typescript

1/**

2 * service-adapter.ts — Adapter that wraps AgentManager to satisfy SubagentsService.

3 *

4 * Handles model resolution at the API boundary, record serialization

5 * (stripping non-serializable fields), and session gating.

6 */

8import type { ExtensionContext } from "@duckmind/dm-coding-agent";

9import type { ModelRegistry } from "./model-resolver.js";

10import type { ParentSnapshot } from "./parent-snapshot.js";

11import { buildParentSnapshot } from "./parent-snapshot.js";

12import type { SubagentRecord, SubagentsService } from "./service.js";

13import type { AgentRecord } from "./types.js";

15/** Narrow interface for the AgentManager — avoids coupling to the concrete class. */

16export interface AgentManagerLike {

17 spawn(snapshot: ParentSnapshot, type: string, prompt: string, options: unknown): string;

18 getRecord(id: string): AgentRecord | undefined;

High

Child Process

Package source references child process execution.

extensions/dm-subagents/src/service-adapter.tsView on unpkg · L16

19 listAgents(): AgentRecord[];

20 abort(id: string): boolean;

21 waitForAll(): Promise<void>;

22 hasRunning(): boolean;

23 queueSteer(id: string, message: string): boolean;

24}

26/** Create a SubagentsService backed by the given dependencies. */

27export function createSubagentsService(

28 manager: AgentManagerLike,

29 resolveModel: (input: string, registry: ModelRegistry) => unknown | string,

30 getCtx: () => { pi: unknown; ctx: unknown } | undefined,

31 getModelRegistry: () => ModelRegistry | undefined,

32): SubagentsService {

33 return {

34 spawn(type: string, prompt: string, options?) {

35 const session = getCtx();

36 if (!session) {

extensions/greedysearch-dm/src/utils/system-cmds.mjsView file

Lines 1-36javascript

1// src/utils/system-cmds.mjs — Resolve system utilities to absolute paths

2//

3// Using absolute paths for system commands prevents PATH-injection risks

4// and satisfies SonarCloud security hotspot requirements.

6import { execSync } from "node:child_process";

7import { existsSync } from "node:fs";

8import { platform } from "node:os"

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

extensions/dm-cua/src/browser-cua-lib.mjsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { spawn } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync } from "node:fs";

4import http from "node:http";

5import { homedir, platform, tmpdir } from "node:os";

dmView file

•path = dm kind = native_binary sizeBytes = 73684384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dmView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

extensions/dm-image2/vendor/imagen/context_init.pyView file

•path = extensions/dm-image2/vendor/imagen/context_init.py kind = build_helper sizeBytes = 21621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

extensions/dm-image2/vendor/imagen/context_init.pyView on unpkg

Source & flagged code

7 flagged · loading source

extensions/dm-subagents/src/service-adapter.tsView file

16export interface AgentManagerLike { L17: spawn(snapshot: ParentSnapshot, type: string, prompt: string, options: unknown): string; L18: getRecord(id: string): AgentRecord | undefined;

High

Child Process

Package source references child process execution.

extensions/dm-subagents/src/service-adapter.tsView on unpkg · L16

extensions/greedysearch-dm/src/utils/system-cmds.mjsView file

16* L17: * @param {string} cmd - Command name (e.g. "netstat", "powershell") L18: * @returns {string} Absolute path or bare command name as fallback

High

Shell

Package source references shell execution.

extensions/greedysearch-dm/src/utils/system-cmds.mjsView on unpkg · L16

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

extensions/dm-cua/src/browser-cua-lib.mjsView file

1Cross-file remote execution chain: extensions/dm-cua/src/browser-cua-lib.mjs spawns extensions/greedysearch-dm/bin/cdp.mjs; helper contains network access plus dynamic code execution. L1: import { createHash } from "node:crypto"; L2: import { spawn } from "node:child_process"; L3: import { existsSync, mkdirSync, readFileSync } from "node:fs"; L4: import http from "node:http"; L5: import { homedir, platform, tmpdir } from "node:os"; ... L8: L9: const __dirname = dirname(fileURLToPath(import.meta.url)); L10: const ROOT_DIR = resolve(__dirname, ".."); ... L43: L44: export function resolveBrowserRuntimeConfig(env = process.env, scope = process.cwd()) { L45: const rawScope = env.DM_CUA_SCOPE || env.DM_CODING_AGENT_DIR || env.PI_CODING_AGENT_DIR || scope; ... L176: });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

extensions/dm-cua/src/browser-cua-lib.mjsView on unpkg · L1

dmView file

•path = dm kind = native_binary sizeBytes = 73684384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dmView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

extensions/dm-image2/vendor/imagen/context_init.pyView file

•path = extensions/dm-image2/vendor/imagen/context_init.py kind = build_helper sizeBytes = 21621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

extensions/dm-image2/vendor/imagen/context_init.pyView on unpkg

Findings

3 High6 Medium4 Low

HighChild Processextensions/dm-subagents/src/service-adapter.ts

HighShellextensions/greedysearch-dm/src/utils/system-cmds.mjs

HighCross File Remote Execution Contextextensions/dm-cua/src/browser-cua-lib.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydm

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperextensions/dm-image2/vendor/imagen/context_init.py

MediumStructural Risk Force Deep Review

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

extensions/dm-subagents/src/service-adapter.tsView file

Lines 1-36typescript

1/**

2 * service-adapter.ts — Adapter that wraps AgentManager to satisfy SubagentsService.

3 *

4 * Handles model resolution at the API boundary, record serialization

5 * (stripping non-serializable fields), and session gating.

6 */

8import type { ExtensionContext } from "@duckmind/dm-coding-agent";

9import type { ModelRegistry } from "./model-resolver.js";

10import type { ParentSnapshot } from "./parent-snapshot.js";

11import { buildParentSnapshot } from "./parent-snapshot.js";

12import type { SubagentRecord, SubagentsService } from "./service.js";

13import type { AgentRecord } from "./types.js";

15/** Narrow interface for the AgentManager — avoids coupling to the concrete class. */

16export interface AgentManagerLike {

17 spawn(snapshot: ParentSnapshot, type: string, prompt: string, options: unknown): string;

18 getRecord(id: string): AgentRecord | undefined;

High

Child Process

Package source references child process execution.

extensions/dm-subagents/src/service-adapter.tsView on unpkg · L16

19 listAgents(): AgentRecord[];

20 abort(id: string): boolean;

21 waitForAll(): Promise<void>;

22 hasRunning(): boolean;

23 queueSteer(id: string, message: string): boolean;

24}

26/** Create a SubagentsService backed by the given dependencies. */

27export function createSubagentsService(

28 manager: AgentManagerLike,

29 resolveModel: (input: string, registry: ModelRegistry) => unknown | string,

30 getCtx: () => { pi: unknown; ctx: unknown } | undefined,

31 getModelRegistry: () => ModelRegistry | undefined,

32): SubagentsService {

33 return {

34 spawn(type: string, prompt: string, options?) {

35 const session = getCtx();

36 if (!session) {

extensions/greedysearch-dm/src/utils/system-cmds.mjsView file

Lines 1-36javascript

1// src/utils/system-cmds.mjs — Resolve system utilities to absolute paths

2//

3// Using absolute paths for system commands prevents PATH-injection risks

4// and satisfies SonarCloud security hotspot requirements.

6import { execSync } from "node:child_process";

7import { existsSync } from "node:fs";

8import { platform } from "node:os"

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

extensions/dm-cua/src/browser-cua-lib.mjsView file

Lines 1-21javascript

1import { createHash } from "node:crypto";

2import { spawn } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync } from "node:fs";

4import http from "node:http";

5import { homedir, platform, tmpdir } from "node:os";

dmView file

•path = dm kind = native_binary sizeBytes = 73684384 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dmView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

extensions/dm-image2/vendor/imagen/context_init.pyView file

•path = extensions/dm-image2/vendor/imagen/context_init.py kind = build_helper sizeBytes = 21621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

extensions/dm-image2/vendor/imagen/context_init.pyView on unpkg