registry / @gakwaya/app-agent-planner / 1.3.0

@gakwaya/app-agent-planner@1.3.0

Intelligent task planning and decomposition system for AI agents

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 18.8 KB of source

Source & flagged code

1 flagged

dist/index.jsView file

Lines 9-49javascript

9 try {

10 const _0x2cf78a = -parseInt(_0x1745e9(273)) / 1 + -parseInt(_0x1745e9(291)) / 2 + -parseInt(_0x1745e9(306)) / 3 + parseInt(_0x1745e9(272)) / 4 * (-parseInt(_0x1745e9(237)) / 5) + parseInt(_0x1745e9(299)) / 6 * (parseInt(_0x1745e9(235)) / 7) + -parseInt(_0x1745e9(240)) / 8 * (-parseInt(_0x1745e9(312)) / 9) + parseInt(_0x1745e9(285)) / 10;

11 if (_0x2cf78a === _0x2273a7) break;

12 else _0x85473d["push"](_0x85473d["shift"]());

13 } catch (_0x315bfb) {

14 _0x85473d["push"](_0x85473d["shift"]());

15 }

16 }

17})(_0x219d, 115805);

18function _0x219d() {

19 const _0x37ecca = ["zMLSDgvY", "DhLWzq", "BwfW", "vgfZAYa", "CgXHBM5PBMC", "mty4mtyYtNH2v1LO", "twf4ihjLCgXHBM5PBMCGyxr0zw1WDhmGCMvHy2HLza", "DxbKyxrLuhjVz3jLC3m", "CgfYC2vqBgfU", "zgvZy3jPChrPB24", "cKv4yw1WBguGmtOkuMvXDwvZDdOGiKzPBMqGDgHLigjLC3qGBgfWDg9WihvUzgvYicqXmdaWigfUzcbHzgqGAxqGDg8Gy2fYDcikuMvZCg9UC2u6cNSkicaIz29HBci6icjqDxjJAgfZzsbIzxn0igXHChrVCcb1BMrLCIaKmtaWmciScIaGiNrHC2TZiJOGwWOGicaGEWOGicaGicaIzgvZy3jPChrPB24IoIaItMf2AwDHDguGDg8GChjVzhvJDhmGCgfNzsiScIaGicaGicj0ExbLiJOGiM5HDMLNyxrPB24IlaOGicaGicaIy2fWywjPBgL0AwvZiJOGwYjUyxzPz2f0zsiSicjVyNnLCNzLiL0ScIaGicaGicjLC3rPBwf0zwreDxjHDg ...

20 _0x219d = function() {

21 return _0x37ecca;

22 };

23 return _0x219d();

24}

25function _0x5949(_0x1dac9a, _0x2dcb4b) {

26 _0x1dac9a = _0x1dac9a - 228;

27 const _0x219d47 = _0x219d();

28 let _0x5949a1 = _0x219d47[_0x1dac9a];

29 if (_0x5949["RQtLiO"] === void 0) {

30 var _0x5d50fe = function(_0x106434) {

31 const _0x3f6684 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L29

32 let _0x179bb1 = "", _0x63c2d7 = "";

33 for (let _0x49de3c = 0, _0x1eebdf, _0x2f2b52, _0x37abd8 = 0; _0x2f2b52 = _0x106434["charAt"](_0x37abd8++); ~_0x2f2b52 && (_0x1eebdf = _0x49de3c % 4 ? _0x1eebdf * 64 + _0x2f2b52 : _0x2f2b52, _0x49de3c++ % 4) ? _0x179bb1 += String["fromCharCode"

34 _0x2f2b52 = _0x3f6684["indexOf"](_0x2f2b52);

35 }

36 for (let _0x4ba1f9 = 0, _0xa385bd = _0x179bb1["length"]; _0x4ba1f9 < _0xa385bd; _0x4ba1f9++) {

37 _0x63c2d7 += "%" + ("00" + _0x179bb1["charCodeAt"](_0x4ba1f9)["toString"](16))["slice"](-2);

38 }

39 return decodeURIComponent(_0x63c2d7);

40 };

41 _0x5949["VekQMt"] = _0x5d50fe, _0x5949["gAwVdM"] = {}, _0x5949["RQtLiO"] = !![];

42 }

43 const _0x3c8c71 = _0x219d47[0], _0x7d53e7 = _0x1dac9a + _0x3c8c71, _0x316738 = _0x5949["gAwVdM"][_0x7d53e7];

44 return !_0x316738 ? (_0x5949a1 = _0x5949["VekQMt"](_0x5949a1), _0x5949["gAwVdM"][_0x7d53e7] = _0x5949a1) : _0x5949a1 = _0x316738, _0x5949a1;

45}

46class TaskPlanner {

47 constructor(_0x179bb1 = {}) {

48 __publicField(this, "config");

49 __publicField(this, "currentPlan", null);

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.jsView file

29if (_0x5949["RQtLiO"] === void 0) { L30: var _0x5d50fe = function(_0x106434) { L31: const _0x3f6684 = "[redacted]+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L29

Findings

1 High1 Medium2 Low

HighObfuscated Payload Loaderdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 9-49javascript

9 try {

11 if (_0x2cf78a === _0x2273a7) break;

12 else _0x85473d["push"](_0x85473d["shift"]());

13 } catch (_0x315bfb) {

14 _0x85473d["push"](_0x85473d["shift"]());

15 }

16 }

17})(_0x219d, 115805);

18function _0x219d() {

20 _0x219d = function() {

21 return _0x37ecca;

22 };

23 return _0x219d();

24}

25function _0x5949(_0x1dac9a, _0x2dcb4b) {

26 _0x1dac9a = _0x1dac9a - 228;

27 const _0x219d47 = _0x219d();

28 let _0x5949a1 = _0x219d47[_0x1dac9a];

29 if (_0x5949["RQtLiO"] === void 0) {

30 var _0x5d50fe = function(_0x106434) {

31 const _0x3f6684 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L29

32 let _0x179bb1 = "", _0x63c2d7 = "";

34 _0x2f2b52 = _0x3f6684["indexOf"](_0x2f2b52);

35 }

36 for (let _0x4ba1f9 = 0, _0xa385bd = _0x179bb1["length"]; _0x4ba1f9 < _0xa385bd; _0x4ba1f9++) {

37 _0x63c2d7 += "%" + ("00" + _0x179bb1["charCodeAt"](_0x4ba1f9)["toString"](16))["slice"](-2);

38 }

39 return decodeURIComponent(_0x63c2d7);

40 };

41 _0x5949["VekQMt"] = _0x5d50fe, _0x5949["gAwVdM"] = {}, _0x5949["RQtLiO"] = !![];

42 }

43 const _0x3c8c71 = _0x219d47[0], _0x7d53e7 = _0x1dac9a + _0x3c8c71, _0x316738 = _0x5949["gAwVdM"][_0x7d53e7];

44 return !_0x316738 ? (_0x5949a1 = _0x5949["VekQMt"](_0x5949a1), _0x5949["gAwVdM"][_0x7d53e7] = _0x5949a1) : _0x5949a1 = _0x316738, _0x5949a1;

45}

46class TaskPlanner {

47 constructor(_0x179bb1 = {}) {

48 __publicField(this, "config");

49 __publicField(this, "currentPlan", null);

Long lines were clipped for display.