registry / @gakwaya/app-agent-core / 1.3.0

@gakwaya/app-agent-core@1.3.0

Core agent logic for App-Agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 106 KB of source

Source & flagged code

1 flagged

dist/index.jsView file

Lines 356-396javascript

356 [_0x480ff9(705)](_0x2aa75f) {

357 const _0x1cc289 = _0x480ff9;

358 _0x2aa75f["scrollIntoView"]({ "behavior": "smooth", "block": _0x1cc289(551) });

359 }

360 async [_0x480ff9(717)](_0x38e2b9, _0x17f372) {

361 const _0x21f0f5 = _0x480ff9, _0x557d76 = new PointerEvent(_0x17f372, { "bubbles": !![], "cancelable": !![], "pointerId": 1, "pointerType": _0x21f0f5(449), "clientX": 0, "clientY": 0 });

362 _0x38e2b9["dispatchEvent"](_0x557d76);

363 }

364 async ["dispatchMouseEvent"](_0x2c3089, _0x41ab46) {

365 const _0x2967bf = _0x480ff9, _0x5b44c3 = new MouseEvent(_0x41ab46, { "bubbles": !![], "cancelable": !![], "view": window, "clientX": 0, "clientY": 0 });

366 _0x2c3089[_0x2967bf(678)](_0x5b44c3);

367 }

368 [_0x480ff9(670)](_0x569731) {

369 return new Promise((_0x3bef76) => setTimeout(_0x3bef76, _0x569731));

370 }

371}

372function _0x19b8(_0x3c5d6d, _0x734184) {

373 _0x3c5d6d = _0x3c5d6d - 263;

374 const _0x436459 = _0x4364();

375 let _0x19b836 = _0x436459[_0x3c5d6d];

376 if (_0x19b8["pZihVN"] === void 0) {

377 var _0x381f1d = function(_0x585342) {

378 const _0x50f34a = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L376

379 let _0x57cf422 = "", _0x2af6aa = "";

380 for (let _0x2d4b4d = 0, _0x4da69a, _0x4bdd67, _0x511876 = 0; _0x4bdd67 = _0x585342["charAt"](_0x511876++); ~_0x4bdd67 && (_0x4da69a = _0x2d4b4d % 4 ? _0x4da69a * 64 + _0x4bdd67 : _0x4bdd67, _0x2d4b4d++ % 4) ? _0x57cf422 += String[

381 _0x4bdd67 = _0x50f34a["indexOf"](_0x4bdd67);

382 }

383 for (let _0x4c75c5 = 0, _0x15d99a = _0x57cf422["length"]; _0x4c75c5 < _0x15d99a; _0x4c75c5++) {

384 _0x2af6aa += "%" + ("00" + _0x57cf422["charCodeAt"](_0x4c75c5)["toString"](16))["slice"](-2);

385 }

386 return decodeURIComponent(_0x2af6aa);

387 };

388 _0x19b8["mOmPAB"] = _0x381f1d, _0x19b8["BjauDG"] = {}, _0x19b8["pZihVN"] = !![];

389 }

390 const _0x5a2188 = _0x436459[0], _0x4a7024 = _0x3c5d6d + _0x5a2188, _0x1ab02b = _0x19b8["BjauDG"][_0x4a7024];

391 return !_0x1ab02b ? (_0x19b836 = _0x19b8["mOmPAB"](_0x19b836), _0x19b8["BjauDG"][_0x4a7024] = _0x19b836) : _0x19b836 = _0x1ab02b, _0x19b836;

392}

393function _0x4364() {

394 const _0x3af4bc = ["C3rYAwn0tMf2AwDHDgLVBG", "ywrKsgLZDg9YEuv2zw50", "DgfZA1n0yxj0zwrbDa", "ihrHyNm", "EYaIAw5KzxGIoIbUDw1IzxiSicj2ywX1zsi6ihn0CMLUzYb9", "CgfYyw1LDgvYCW", "BgfZDfvsta", "C3rHDhvZ", "C3rLCa", "BgfIzwW", "Aw5KzxG", "C2HVDwXKuMvIDwLSzerptq", "Bwf0y2HLC0jSywnRBgLZDa", "CgfYC2u", "Aw5JBhvKzvrHyNm", "AgfZqxr0CMLIDxrL", "ywX0", "tMf2AwDHDgvKihrVia", "yNv0Dg9Uw2fYAweTzxHWyw5KzwrD", "odq5mdHtDgzOq3O"

395 _0x4364 = function() {

396 return _0x3af4bc;

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.jsView file

376if (_0x19b8["pZihVN"] === void 0) { L377: var _0x381f1d = function(_0x585342) { L378: const _0x50f34a = "[redacted]+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L376

Findings

1 High1 Medium2 Low

HighObfuscated Payload Loaderdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 356-396javascript

356 [_0x480ff9(705)](_0x2aa75f) {

357 const _0x1cc289 = _0x480ff9;

358 _0x2aa75f["scrollIntoView"]({ "behavior": "smooth", "block": _0x1cc289(551) });

359 }

360 async [_0x480ff9(717)](_0x38e2b9, _0x17f372) {

361 const _0x21f0f5 = _0x480ff9, _0x557d76 = new PointerEvent(_0x17f372, { "bubbles": !![], "cancelable": !![], "pointerId": 1, "pointerType": _0x21f0f5(449), "clientX": 0, "clientY": 0 });

362 _0x38e2b9["dispatchEvent"](_0x557d76);

363 }

364 async ["dispatchMouseEvent"](_0x2c3089, _0x41ab46) {

365 const _0x2967bf = _0x480ff9, _0x5b44c3 = new MouseEvent(_0x41ab46, { "bubbles": !![], "cancelable": !![], "view": window, "clientX": 0, "clientY": 0 });

366 _0x2c3089[_0x2967bf(678)](_0x5b44c3);

367 }

368 [_0x480ff9(670)](_0x569731) {

369 return new Promise((_0x3bef76) => setTimeout(_0x3bef76, _0x569731));

370 }

371}

372function _0x19b8(_0x3c5d6d, _0x734184) {

373 _0x3c5d6d = _0x3c5d6d - 263;

374 const _0x436459 = _0x4364();

375 let _0x19b836 = _0x436459[_0x3c5d6d];

376 if (_0x19b8["pZihVN"] === void 0) {

377 var _0x381f1d = function(_0x585342) {

378 const _0x50f34a = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L376

379 let _0x57cf422 = "", _0x2af6aa = "";

381 _0x4bdd67 = _0x50f34a["indexOf"](_0x4bdd67);

382 }

383 for (let _0x4c75c5 = 0, _0x15d99a = _0x57cf422["length"]; _0x4c75c5 < _0x15d99a; _0x4c75c5++) {

384 _0x2af6aa += "%" + ("00" + _0x57cf422["charCodeAt"](_0x4c75c5)["toString"](16))["slice"](-2);

385 }

386 return decodeURIComponent(_0x2af6aa);

387 };

388 _0x19b8["mOmPAB"] = _0x381f1d, _0x19b8["BjauDG"] = {}, _0x19b8["pZihVN"] = !![];

389 }

390 const _0x5a2188 = _0x436459[0], _0x4a7024 = _0x3c5d6d + _0x5a2188, _0x1ab02b = _0x19b8["BjauDG"][_0x4a7024];

391 return !_0x1ab02b ? (_0x19b836 = _0x19b8["mOmPAB"](_0x19b836), _0x19b8["BjauDG"][_0x4a7024] = _0x19b836) : _0x19b836 = _0x1ab02b, _0x19b836;

392}

393function _0x4364() {

395 _0x4364 = function() {

396 return _0x3af4bc;

Long lines were clipped for display.