registry / @edgeai/edge-client-ts / 1.1.0

@edgeai/edge-client-ts@1.1.0

TypeScript edge-client for the Edge AI Agent fleet — pure-npm reimplementation of the Rust `ec` binary with byte-compatible wire protocol.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

This package is a configurable edge-agent client with remote relay, local coding-agent, PTY, and SFTP capabilities. Those actions require explicit CLI/library use; no install-time execution or unconsented persistence path is wired.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `ec-ts run` or a consumer invokes session/service APIs.

Impact

A trusted relay or library caller could obtain code-agent execution, shell interaction, and filesystem operations on the enrolled host.

Mechanism

Configured WebSocket relay plus local `pi`, PTY, SFTP, and optional service-manager APIs.

Rationale

No concrete malicious install-time behavior, credential harvesting, or package-owned exfiltration was found. The package nevertheless provides high-impact remote-agent primitives, so it warrants a warning under the dangerous-capability boundary.

Evidence

package.jsonbin/ec-ts.jsdist/cli/run.jsdist/session/pi-rpc.jsdist/session/shell.jsdist/session/sftp.jsdist/daemon/manager.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

@edgeai/edge-client-ts@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code