registry / @glasstrace/sdk / 1.28.0

@glasstrace/sdk@1.28.0

⚠ Under review

Glasstrace server-side debugging SDK for AI coding agents

Static Scan Results

scanned 23h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 55 file(s), 7.65 MB of source, external domains: api.glasstrace.dev, glasstrace.dev, glasstrace.invalid, json-schema.org

Source & flagged code

9 flagged

dist/chunk-WZXVS2EO.jsView file

Lines 1-9javascript

1// ../../node_modules/@opentelemetry/resources/build/esm/detectors/platform/node/machine-id/execAsync.js

2import * as child_process from "child_process";

High

Shell

Package source references shell execution.

dist/chunk-WZXVS2EO.jsView on unpkg · L1

3import * as util from "util";

High

Child Process

Package source references child process execution.

dist/chunk-WZXVS2EO.jsView on unpkg · L1

4var execAsync = util.promisify(child_process.exec);

6export {

7 execAsync

8};

9//# sourceMappingURL=chunk-WZXVS2EO.js.map

dist/chunk-XLIDQG67.jsView file

Lines 218-258javascript

218 // positives on dotted text like a stack-trace frame

219 // (`react.dom.server`) while still catching every real JWT we have

220 // seen in the wild. Anchored with word boundaries on both sides so

221 // a 3-dot semantic version like "next@15.4.1.2" does not match.

222 pattern: /\b[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g

223 },

dist/cli/init.cjsView file

154assignProp: () => assignProp, L155: base64ToUint8Array: () => base64ToUint8Array, L156: base64urlToUint8Array: () => base64urlToUint8Array, ... L1034: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1035: } : { success: true, data: result.value }; L1036: }; ... L2563: try { L2564: new URL(`http://[${payload.value}]`); L2565: } catch { ... L15541: async function readAnonKey(projectRoot) { L15542: const root = projectRoot ?? process.cwd(); L15543: const modules = await loadFsPath();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/init.cjsView on unpkg · L154

dist/index.cjsView file

40Cross-file remote execution chain: dist/index.cjs spawns dist/middleware/index.cjs; helper contains network access plus dynamic code execution. L40: return { L41: GLASSTRACE_API_KEY: process.env.GLASSTRACE_API_KEY?.trim() || void 0, L42: GLASSTRACE_FORCE_ENABLE: process.env.GLASSTRACE_FORCE_ENABLE, ... L94: "use strict"; L95: DEFAULT_ENDPOINT = "https://api.glasstrace.dev"; L96: } ... L194: assignProp: () => assignProp, L195: base64ToUint8Array: () => base64ToUint8Array, L196: base64urlToUint8Array: () => base64urlToUint8Array, ... L1074: error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config()))) L1075: } : { success: true, data: result.value }; L1076: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L40

20179patternName = generic_password severity = medium line = 20179 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L20179

dist/cli/upgrade-instructions.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @glasstrace/sdk@1.26.0 matchedIdentity = npm:QGdsYXNzdHJhY2Uvc2Rr:1.26.0 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/upgrade-instructions.cjsView on unpkg

dist/node-entry.cjsView file

20149patternName = generic_password severity = medium line = 20149 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/node-entry.cjs

dist/node-entry.cjsView on unpkg · L20149

Source & flagged code

9 flagged · loading source

dist/chunk-WZXVS2EO.jsView file

1// ../../node_modules/@[redacted]-id/execAsync.js L2: import * as child_process from "child_process"; L3: import * as util from "util";

High

Child Process

Package source references child process execution.

dist/chunk-WZXVS2EO.jsView on unpkg · L1

1// ../../node_modules/@[redacted]-id/execAsync.js L2: import * as child_process from "child_process";

High

Shell

Package source references shell execution.

dist/chunk-WZXVS2EO.jsView on unpkg · L1

dist/chunk-XLIDQG67.jsView file

3770const isInsecure = protocol === "http:"; L3771: const module = isInsecure ? import("http") : import("https"); L3772: const { Agent } = await module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-XLIDQG67.jsView on unpkg · L3770

238patternName = generic_password severity = medium line = 238 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/chunk-XLIDQG67.js

dist/chunk-XLIDQG67.jsView on unpkg · L238

dist/cli/init.cjsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/init.cjsView on unpkg · L154

dist/index.cjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L40

20179patternName = generic_password severity = medium line = 20179 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L20179

dist/cli/upgrade-instructions.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/upgrade-instructions.cjsView on unpkg

dist/node-entry.cjsView file

20149patternName = generic_password severity = medium line = 20149 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/node-entry.cjs

dist/node-entry.cjsView on unpkg · L20149

Findings

1 Critical4 High8 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli/upgrade-instructions.cjs

HighChild Processdist/chunk-WZXVS2EO.js

HighShelldist/chunk-WZXVS2EO.js

HighSandbox Evasion Gated Capabilitydist/cli/init.cjs

HighCross File Remote Execution Contextdist/index.cjs

MediumDynamic Requiredist/chunk-XLIDQG67.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

MediumSecret Patterndist/chunk-XLIDQG67.js

MediumSecret Patterndist/node-entry.cjs

MediumSecret Patterndist/index.cjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/chunk-WZXVS2EO.jsView file

Lines 1-9javascript

1// ../../node_modules/@opentelemetry/resources/build/esm/detectors/platform/node/machine-id/execAsync.js

2import * as child_process from "child_process";

High

Shell

Package source references shell execution.

dist/chunk-WZXVS2EO.jsView on unpkg · L1

3import * as util from "util";

High

Child Process

Package source references child process execution.

dist/chunk-WZXVS2EO.jsView on unpkg · L1

4var execAsync = util.promisify(child_process.exec);

6export {

7 execAsync

8};

9//# sourceMappingURL=chunk-WZXVS2EO.js.map

dist/chunk-XLIDQG67.jsView file

Lines 218-258javascript

218 // positives on dotted text like a stack-trace frame

219 // (`react.dom.server`) while still catching every real JWT we have

220 // seen in the wild. Anchored with word boundaries on both sides so

221 // a 3-dot semantic version like "next@15.4.1.2" does not match.

222 pattern: /\b[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g

223 },

dist/cli/init.cjsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/init.cjsView on unpkg · L154

dist/index.cjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.cjsView on unpkg · L40

20179patternName = generic_password severity = medium line = 20179 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/index.cjs

dist/index.cjsView on unpkg · L20179

dist/cli/upgrade-instructions.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/upgrade-instructions.cjsView on unpkg

dist/node-entry.cjsView file

20149patternName = generic_password severity = medium line = 20149 matchedText = // `pass...d of

Medium

Secret Pattern

Hardcoded password in dist/node-entry.cjs

dist/node-entry.cjsView on unpkg · L20149

Lines 3750-3790javascript

3750 }

3751}

3752function mergeOtlpHttpConfigurationWithDefaults(userProvidedConfiguration, fallbackConfiguration, defaultConfiguration) {

3753 return {

3754 ...mergeOtlpSharedConfigurationWithDefaults(userProvidedConfiguration, fallbackConfiguration, defaultConfiguration),

3755 headers: mergeHeaders(userProvidedConfiguration.headers, fallbackConfiguration.headers, defaultConfiguration.headers),

3756 url: validateUserProvidedUrl(userProvidedConfiguration.url) ?? fallbackConfiguration.url ?? defaultConfiguration.url

3757 };

3758}

3759function getHttpConfigurationDefaults(requiredHeaders, signalResourcePath) {

3760 return {

3761 ...getSharedConfigurationDefaults(),

3762 headers: async () => requiredHeaders,

3763 url: "http://localhost:4318/" + signalResourcePath

3764 };

3765}

3766

3767// ../../node_modules/@opentelemetry/otlp-exporter-base/build/esm/configuration/otlp-node-http-configuration.js

3768function httpAgentFactoryFromOptions(options) {

3769 return async (protocol) => {

3770 const isInsecure = protocol === "http:";

3771 const module = isInsecure ? import("http") : import("https");

3772 const { Agent } = await module;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-XLIDQG67.jsView on unpkg · L3770

3773 if (isInsecure) {

3774 const { ca, cert, key, ...insecureOptions } = options;

3775 return new Agent(insecureOptions);

3776 }

3777 return new Agent(options);

3778 };

3779}

3780function mergeOtlpNodeHttpConfigurationWithDefaults(userProvidedConfiguration, fallbackConfiguration, defaultConfiguration) {

3781 return {

3782 ...mergeOtlpHttpConfigurationWithDefaults(userProvidedConfiguration, fallbackConfiguration, defaultConfiguration),

3783 agentFactory: userProvidedConfiguration.agentFactory ?? fallbackConfiguration.agentFactory ?? defaultConfiguration.agentFactory,

3784 userAgent: userProvidedConfiguration.userAgent

3785 };

3786}

3787function getNodeHttpConfigurationDefaults(requiredHeaders, signalResourcePath) {

3788 return {

3789 ...getHttpConfigurationDefaults(requiredHeaders, signalResourcePath),

3790 agentFactory: httpAgentFactoryFromOptions({ keepAlive: true })