registry / @gakwaya/app-agent-workflow / 1.3.0

@gakwaya/app-agent-workflow@1.3.0

Complex workflow orchestration with state management and error recovery

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

Eval

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 22.6 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 2-42javascript

2var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;

3var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);

4var _a, _b, _c, _d, _e;

5const _0x10808c = _0x1e10;

6(function(_0x4f4c37, _0x2cc6d8) {

7 const _0xa5d190 = _0x1e10, _0x313fa3 = _0x4f4c37();

8 while (!![]) {

9 try {

10 const _0xaed877 = parseInt(_0xa5d190(449)) / 1 + -parseInt(_0xa5d190(444)) / 2 * (-parseInt(_0xa5d190(486)) / 3) + -parseInt(_0xa5d190(509

11 if (_0xaed877 === _0x2cc6d8) break;

12 else _0x313fa3["push"](_0x313fa3["shift"]());

13 } catch (_0x33e38e) {

14 _0x313fa3["push"](_0x313fa3["shift"]());

15 }

16 }

17})(_0x19ae, 148557);

18function _0x1e10(_0x45ec69, _0xb97ce9) {

19 _0x45ec69 = _0x45ec69 - 414;

20 const _0x19ae30 = _0x19ae();

21 let _0x1e10f4 = _0x19ae30[_0x45ec69];

22 if (_0x1e10["mkUisN"] === void 0) {

23 var _0x41829e = function(_0x34d2ba) {

24 const _0x504049 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L22

25 let _0x422b5f2 = "", _0x41badd = "";

26 for (let _0x30f47a = 0, _0x451d94, _0x489527, _0x411f69 = 0; _0x489527 = _0x34d2ba["charAt"](_0x411f69++); ~_0x489527 && (_0x451d94 = _0x30f47a % 4 ? _0x451d94 * 64 + _0x489527 : _0x489527, _0x30f47a++ % 4) ? _0x422b5f2 += String["fromCharCode"

27 _0x489527 = _0x504049["indexOf"](_0x489527);

28 }

29 for (let _0xd29483 = 0, _0x20b765 = _0x422b5f2["length"]; _0xd29483 < _0x20b765; _0xd29483++) {

30 _0x41badd += "%" + ("00" + _0x422b5f2["charCodeAt"](_0xd29483)["toString"](16))["slice"](-2);

31 }

32 return decodeURIComponent(_0x41badd);

33 };

34 _0x1e10["lxKccN"] = _0x41829e, _0x1e10["glgsMp"] = {}, _0x1e10["mkUisN"] = !![];

35 }

36 const _0xdcaf03 = _0x19ae30[0], _0x406c60 = _0x45ec69 + _0xdcaf03, _0x243290 = _0x1e10["glgsMp"][_0x406c60];

37 return !_0x243290 ? (_0x1e10f4 = _0x1e10["lxKccN"](_0x1e10f4), _0x1e10["glgsMp"][_0x406c60] = _0x1e10f4) : _0x1e10f4 = _0x243290, _0x1e10f4;

38}

39import _0x422b5f from "eventemitter3";

40import { LocalStorageAdapter } from "@gakwaya/app-agent-entities";

41class WorkflowEngine extends _0x422b5f {

42 constructor(_0x41badd = {}) {

Lines 253-293javascript

253 if (typeof _0xc1ae35 === _0x382cbc(510) && _0xc1ae35[_0x382cbc(416)]("$")) {

254 const _0x4b84db = _0xc1ae35["substring"](1);

255 _0xa73d73[_0x308eaf] = _0x4aa608[_0x4b84db];

256 } else _0xa73d73[_0x308eaf] = _0xc1ae35;

Source & flagged code

2 flagged · loading source

dist/index.jsView file

22if (_0x1e10["mkUisN"] === void 0) { L23: var _0x41829e = function(_0x34d2ba) { L24: const _0x504049 = "[redacted]+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L22

273}); L274: return new Function("return " + _0x3d56e7)(); L275: } catch {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L273

Findings

1 High1 Medium3 Low

HighObfuscated Payload Loaderdist/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/index.js

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 2-42javascript

2var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;

3var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);

4var _a, _b, _c, _d, _e;

5const _0x10808c = _0x1e10;

6(function(_0x4f4c37, _0x2cc6d8) {

7 const _0xa5d190 = _0x1e10, _0x313fa3 = _0x4f4c37();

8 while (!![]) {

9 try {

10 const _0xaed877 = parseInt(_0xa5d190(449)) / 1 + -parseInt(_0xa5d190(444)) / 2 * (-parseInt(_0xa5d190(486)) / 3) + -parseInt(_0xa5d190(509

11 if (_0xaed877 === _0x2cc6d8) break;

12 else _0x313fa3["push"](_0x313fa3["shift"]());

13 } catch (_0x33e38e) {

14 _0x313fa3["push"](_0x313fa3["shift"]());

15 }

16 }

17})(_0x19ae, 148557);

18function _0x1e10(_0x45ec69, _0xb97ce9) {

19 _0x45ec69 = _0x45ec69 - 414;

20 const _0x19ae30 = _0x19ae();

21 let _0x1e10f4 = _0x19ae30[_0x45ec69];

22 if (_0x1e10["mkUisN"] === void 0) {

23 var _0x41829e = function(_0x34d2ba) {

24 const _0x504049 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L22

25 let _0x422b5f2 = "", _0x41badd = "";

27 _0x489527 = _0x504049["indexOf"](_0x489527);

28 }

29 for (let _0xd29483 = 0, _0x20b765 = _0x422b5f2["length"]; _0xd29483 < _0x20b765; _0xd29483++) {

30 _0x41badd += "%" + ("00" + _0x422b5f2["charCodeAt"](_0xd29483)["toString"](16))["slice"](-2);

31 }

32 return decodeURIComponent(_0x41badd);

33 };

34 _0x1e10["lxKccN"] = _0x41829e, _0x1e10["glgsMp"] = {}, _0x1e10["mkUisN"] = !![];

35 }

36 const _0xdcaf03 = _0x19ae30[0], _0x406c60 = _0x45ec69 + _0xdcaf03, _0x243290 = _0x1e10["glgsMp"][_0x406c60];

37 return !_0x243290 ? (_0x1e10f4 = _0x1e10["lxKccN"](_0x1e10f4), _0x1e10["glgsMp"][_0x406c60] = _0x1e10f4) : _0x1e10f4 = _0x243290, _0x1e10f4;

38}

39import _0x422b5f from "eventemitter3";

40import { LocalStorageAdapter } from "@gakwaya/app-agent-entities";

41class WorkflowEngine extends _0x422b5f {

42 constructor(_0x41badd = {}) {

Lines 253-293javascript

253 if (typeof _0xc1ae35 === _0x382cbc(510) && _0xc1ae35[_0x382cbc(416)]("$")) {

254 const _0x4b84db = _0xc1ae35["substring"](1);

255 _0xa73d73[_0x308eaf] = _0x4aa608[_0x4b84db];

256 } else _0xa73d73[_0x308eaf] = _0xc1ae35;