registry / @gakwaya/app-agent-tools / 1.3.0

@gakwaya/app-agent-tools@1.3.0

Advanced tool system with composition, discovery, and enhanced execution

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 4 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 25.5 KB of source

Source & flagged code

1 flagged

dist/index.jsView file

Lines 253-293javascript

253 ["generateId"]() {

254 const _0x438551 = _0x3cb30f;

255 return "tool-" + Date["now"]() + "-" + Math[_0x438551(388)]()[_0x438551(278)](36)["substr"](2, 9);

256 }

257}

258function _0x1969() {

259 const _0x26cf3a = ["Dg9tDhjPBMC", "C3vJy2vZCW", "zw50CMLLCW", "zw5HyMXLtwv0CMLJCW", "vg9VBcbTDxn0igHHDMuGAw5WDxqGC2nOzw1H", "zg9Uzq", "C2nYB2XS", "z2v0vg9VBa", "ugfYywXSzwWGzxHLy3v0Aw9UigzHAwXLza", "DgvYBxm", "DMfSDwu", "y2f0zwDVCNK", "mte5mtmZmdrYCxjzvgO", "BM93", "y2fJAgviAxrsyxrL", "BwfW", "y29TCg9ZAxrPB25Z", "zNjVBq", "zgvSyxK", "ovnkAMHOCq",

260 _0x1969 = function() {

261 return _0x26cf3a;

262 };

263 return _0x1969();

264}

265function baseMetadata(_0x6aae4) {

266 const _0x42b371 = _0x3cb30f;

267 return { "tags": [_0x42b371(303), _0x6aae4], "examples": [], "capabilities": [_0x6aae4], "riskLevel": "low" };

268}

269function _0x3fdd(_0x5b2265, _0x1226ab) {

270 _0x5b2265 = _0x5b2265 - 268;

271 const _0x196972 = _0x1969();

272 let _0x3fddaf = _0x196972[_0x5b2265];

273 if (_0x3fdd["ZRHmSs"] === void 0) {

274 var _0x1d32ae = function(_0x409b75) {

275 const _0x996c5 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L273

276 let _0x3c61262 = "", _0x442e00 = "";

277 for (let _0x5c4382 = 0, _0xa0588f, _0x17431c, _0x34ef22 = 0; _0x17431c = _0x409b75["charAt"](_0x34ef22++); ~_0x17431c && (_0xa0588f = _0x5c4382 % 4 ? _0xa0588f * 64 + _0x17431c : _0x17431c, _0x5c4382++ % 4) ? _0x3c61262 += String[

278 _0x17431c = _0x996c5["indexOf"](_0x17431c);

279 }

280 for (let _0x3d9c66 = 0, _0x3710ec = _0x3c61262["length"]; _0x3d9c66 < _0x3710ec; _0x3d9c66++) {

281 _0x442e00 += "%" + ("00" + _0x3c61262["charCodeAt"](_0x3d9c66)["toString"](16))["slice"](-2);

282 }

283 return decodeURIComponent(_0x442e00);

284 };

285 _0x3fdd["AOhWFI"] = _0x1d32ae, _0x3fdd["thXFmU"] = {}, _0x3fdd["ZRHmSs"] = !![];

286 }

287 const _0x3e4575 = _0x196972[0], _0x3ec1ed = _0x5b2265 + _0x3e4575, _0x536369 = _0x3fdd["thXFmU"][_0x3ec1ed];

288 return !_0x536369 ? (_0x3fddaf = _0x3fdd["AOhWFI"](_0x3fddaf), _0x3fdd["thXFmU"][_0x3ec1ed] = _0x3fddaf) : _0x3fddaf = _0x536369, _0x3fddaf;

289}

290function createBuiltinTools(_0x17d7a2) {

291 const _0x84c931 = _0x3cb30f;

292 return [{ "id": _0x84c931(283), "name": "done", "description": "Mark the task as complete", "category": "utility", "inputSchema": toolSchemas["done"], "execute": async () => "Task completed", "metadata": baseMetadata("done") }, { "id": "wait", "name": "wait", "description"

293 var _a2;

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

dist/index.jsView file

273if (_0x3fdd["ZRHmSs"] === void 0) { L274: var _0x1d32ae = function(_0x409b75) { L275: const _0x996c5 = "[redacted]+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L273

Findings

1 High1 Medium2 Low

HighObfuscated Payload Loaderdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/index.jsView file

Lines 253-293javascript

253 ["generateId"]() {

254 const _0x438551 = _0x3cb30f;

255 return "tool-" + Date["now"]() + "-" + Math[_0x438551(388)]()[_0x438551(278)](36)["substr"](2, 9);

256 }

257}

258function _0x1969() {

260 _0x1969 = function() {

261 return _0x26cf3a;

262 };

263 return _0x1969();

264}

265function baseMetadata(_0x6aae4) {

266 const _0x42b371 = _0x3cb30f;

267 return { "tags": [_0x42b371(303), _0x6aae4], "examples": [], "capabilities": [_0x6aae4], "riskLevel": "low" };

268}

269function _0x3fdd(_0x5b2265, _0x1226ab) {

270 _0x5b2265 = _0x5b2265 - 268;

271 const _0x196972 = _0x1969();

272 let _0x3fddaf = _0x196972[_0x5b2265];

273 if (_0x3fdd["ZRHmSs"] === void 0) {

274 var _0x1d32ae = function(_0x409b75) {

275 const _0x996c5 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L273

276 let _0x3c61262 = "", _0x442e00 = "";

278 _0x17431c = _0x996c5["indexOf"](_0x17431c);

279 }

280 for (let _0x3d9c66 = 0, _0x3710ec = _0x3c61262["length"]; _0x3d9c66 < _0x3710ec; _0x3d9c66++) {

281 _0x442e00 += "%" + ("00" + _0x3c61262["charCodeAt"](_0x3d9c66)["toString"](16))["slice"](-2);

282 }

283 return decodeURIComponent(_0x442e00);

284 };

285 _0x3fdd["AOhWFI"] = _0x1d32ae, _0x3fdd["thXFmU"] = {}, _0x3fdd["ZRHmSs"] = !![];

286 }

287 const _0x3e4575 = _0x196972[0], _0x3ec1ed = _0x5b2265 + _0x3e4575, _0x536369 = _0x3fdd["thXFmU"][_0x3ec1ed];

288 return !_0x536369 ? (_0x3fddaf = _0x3fdd["AOhWFI"](_0x3fddaf), _0x3fdd["thXFmU"][_0x3ec1ed] = _0x3fddaf) : _0x3fddaf = _0x536369, _0x3fddaf;

289}

290function createBuiltinTools(_0x17d7a2) {

291 const _0x84c931 = _0x3cb30f;

293 var _a2;

Long lines were clipped for display.