registry / @executor-js/sdk / 1.5.27

@executor-js/sdk@1.5.27

A TypeScript SDK for building executors that wire together tool sources, secrets, and policies across MCP, OpenAPI, GraphQL, and custom plugins.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 1.07 MB of source, external domains: 127.0.0.1, github.com

Oversized source lightweight scan

dist/testing.js10.2 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStrings127.0.0.1

Source & flagged code

2 flagged

dist/host-internal.jsView file

Lines 44-84javascript

44 )) {

45 return null;

46 }

47 const [high, low] = words;

48 return [high >> 8, high & 255, low >> 8, low & 255];

49};

50var isBlockedIpv4 = ([a, b]) => a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169

51var isBlockedIpv6 = (hostname) => {

52 const normalized = hostname.toLowerCase();

53 if (normalized === "::" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:0" || normalized === "0:0:0:0:0:0:0:1") {

54 return true;

55 }

56 const firstWordText = normalized.split(":").find((part) => part.length > 0);

57 if (!firstWordText || !/^[0-9a-f]{1,4}$/.test(firstWordText)) return false;

58 const firstWord = Number.parseInt(firstWordText, 16);

59 return (firstWord & 65472) === 65152 || (firstWord & 65024) === 64512 || (firstWord & 65280) === 65280;

60};

61var isBlockedMetadataHostname = (hostname) => {

62 const normalized = hostname.toLowerCase();

63 return normalized === "metadata.google.internal" || normalized === "metadata" || normalized === "instance-data" || normalized === "169.254.169.254";

64};

65var isLocalOrPrivateHostname = (hostname) => {

66 const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/host-internal.jsView on unpkg · L64

67 if (normalized === "localhost" || normalized.endsWith(".localhost")) return true;

68 const ipv4 = parseIpv4(normalized);

69 if (ipv4) return isBlockedIpv4(ipv4);

70 const mappedIpv4 = parseIpv4MappedIpv6(normalized);

71 if (mappedIpv4) return isBlockedIpv4(mappedIpv4);

72 return isBlockedIpv6(normalized);

73};

74var isAddressLiteral = (hostname) => {

75 const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");

76 return parseIpv4(normalized) !== null || /^[0-9a-f:.]+$/i.test(normalized);

77};

78var resolveHostnameWithNodeDns = async (hostname) => {

79 const { lookup } = await import("dns/promises");

80 const addresses = await lookup(hostname, { all: true, verbatim: true });

81 return addresses.map(({ address, family }) => ({

82 address,

83 family: family === 6 ? 6 : 4

84 }));

dist/testing.jsView file

•path = dist/testing.js kind = oversized_source_file sizeBytes = 10733022 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/testing.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/host-internal.jsView file

64}; L65: var isLocalOrPrivateHostname = (hostname) => { L66: const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, ""); ... L171: // oxlint-disable-next-line executor/no-raw-fetch -- boundary: exposes a guarded Fetch API adapter for libraries that require fetch L172: guardFetch(options.fetch ?? globalThis.fetch, options) L173: );

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/host-internal.jsView on unpkg · L64

dist/testing.jsView file

•path = dist/testing.js kind = oversized_source_file sizeBytes = 10733022 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/testing.jsView on unpkg

Findings

2 High4 Medium4 Low

HighCloud Metadata Accessdist/host-internal.js

HighOversized Source Filedist/testing.js

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/host-internal.jsView file

Lines 44-84javascript

44 )) {

45 return null;

46 }

47 const [high, low] = words;

48 return [high >> 8, high & 255, low >> 8, low & 255];

49};

50var isBlockedIpv4 = ([a, b]) => a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169

51var isBlockedIpv6 = (hostname) => {

52 const normalized = hostname.toLowerCase();

53 if (normalized === "::" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:0" || normalized === "0:0:0:0:0:0:0:1") {

54 return true;

55 }

56 const firstWordText = normalized.split(":").find((part) => part.length > 0);

57 if (!firstWordText || !/^[0-9a-f]{1,4}$/.test(firstWordText)) return false;

58 const firstWord = Number.parseInt(firstWordText, 16);

59 return (firstWord & 65472) === 65152 || (firstWord & 65024) === 64512 || (firstWord & 65280) === 65280;

60};

61var isBlockedMetadataHostname = (hostname) => {

62 const normalized = hostname.toLowerCase();

63 return normalized === "metadata.google.internal" || normalized === "metadata" || normalized === "instance-data" || normalized === "169.254.169.254";

64};

65var isLocalOrPrivateHostname = (hostname) => {

66 const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/host-internal.jsView on unpkg · L64

67 if (normalized === "localhost" || normalized.endsWith(".localhost")) return true;

68 const ipv4 = parseIpv4(normalized);

69 if (ipv4) return isBlockedIpv4(ipv4);

70 const mappedIpv4 = parseIpv4MappedIpv6(normalized);

71 if (mappedIpv4) return isBlockedIpv4(mappedIpv4);

72 return isBlockedIpv6(normalized);

73};

74var isAddressLiteral = (hostname) => {

75 const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");

76 return parseIpv4(normalized) !== null || /^[0-9a-f:.]+$/i.test(normalized);

77};

78var resolveHostnameWithNodeDns = async (hostname) => {

79 const { lookup } = await import("dns/promises");

80 const addresses = await lookup(hostname, { all: true, verbatim: true });

81 return addresses.map(({ address, family }) => ({

82 address,

83 family: family === 6 ? 6 : 4

84 }));

dist/testing.jsView file

•path = dist/testing.js kind = oversized_source_file sizeBytes = 10733022 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/testing.jsView on unpkg