registry / @gridlock-compute/native-worker / 0.1.1

@gridlock-compute/native-worker@0.1.1

Native CLI worker for the Gridlock inference network. Connects over WebSocket and runs jobs via Ollama or vLLM.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 65.5 KB of source, external domains: 127.0.0.1, api.grid-lock.tech, grid-lock.tech, ollama.com

Source & flagged code

3 flagged

dist/gpu.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/gpu.jsView on unpkg · L1

3import { existsSync } from "node:fs";

4import { join } from "node:path";

5import { promisify } from "node:util";

6import { cpus } from "node:os";

7const execFileAsync = promisify(execFile);

8async function runCmd(command, args) {

9 try {

10 const { stdout } = await execFileAsync(command, args, {

11 timeout: 8_000,

12 maxBuffer: 1024 * 1024,

13 windowsHide: true,

14 });

15 const text = stdout.trim();

16 return text || null;

17 }

18 catch {

19 return null;

20 }

21}

dist/ollama.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { existsSync } from "node:fs";

3import { join } from "node:path";

4import { workerLog } from "./console-io.js";

5import { isInteractiveTerminal, promptOllamaModel } from "./model-select.js";

Source & flagged code

3 flagged · loading source

dist/gpu.jsView file

1import { execFile } from "node:child_process"; L2: import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/gpu.jsView on unpkg · L1

dist/ollama.jsView file

54throw new Error("Ollama is not installed.\n" + L55: " 1. Download from https://ollama.com/download\n" + L56: " 2. Install, then open Ollama from the Start menu\n" + ... L58: } L59: if (process.env.GRIDLOCK_SKIP_OLLAMA_INSTALL === "true") { L60: throw new Error("Ollama is not installed. Set GRIDLOCK_SKIP_OLLAMA_INSTALL=false or install from https://ollama.com/download"); ... L62: workerLog("Ollama not found — installing via https://ollama.com/install.sh …"); L63: const result = spawnSync("sh", ["-c", "curl -fsSL https://ollama.com/install.sh | sh"], { L64: stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ollama.jsView on unpkg · L54

1import { spawn, spawnSync } from "node:child_process"; L2: import { existsSync } from "node:fs"; ... L10: try { L11: const res = await fetch(`${baseUrl}/api/version`, { signal: AbortSignal.timeout(5000) }); L12: return res.ok; ... L19: const candidates = []; L20: if (process.env.GRIDLOCK_OLLAMA_BIN) { L21: candidates.push(process.env.GRIDLOCK_OLLAMA_BIN); L22: } L23: if (process.platform === "win32") { L24: if (process.env.LOCALAPPDATA) { ... L40: const out = spawnSync(cmd, [candidate], { encoding: "utf8" });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/ollama.jsView on unpkg · L1

Findings

4 High3 Medium4 Low

HighChild Processdist/gpu.js

HighShell

HighSame File Env Network Executiondist/ollama.js

HighSandbox Evasion Gated Capabilitydist/ollama.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/gpu.jsView file

Lines 1-21javascript

1import { execFile } from "node:child_process";

2import { readFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/gpu.jsView on unpkg · L1

3import { existsSync } from "node:fs";

4import { join } from "node:path";

5import { promisify } from "node:util";

6import { cpus } from "node:os";

7const execFileAsync = promisify(execFile);

8async function runCmd(command, args) {

9 try {

10 const { stdout } = await execFileAsync(command, args, {

11 timeout: 8_000,

12 maxBuffer: 1024 * 1024,

13 windowsHide: true,

14 });

15 const text = stdout.trim();

16 return text || null;

17 }

18 catch {

19 return null;

20 }

21}

dist/ollama.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { existsSync } from "node:fs";

3import { join } from "node:path";

4import { workerLog } from "./console-io.js";

5import { isInteractiveTerminal, promptOllamaModel } from "./model-select.js";

Lines 34-74javascript

34 if (existsSync(candidate))

35 return candidate;

36 continue;

37 }

38 try {

39 const cmd = process.platform === "win32" ? "where" : "which";

40 const out = spawnSync(cmd, [candidate], { encoding: "utf8" });

41 if (out.status === 0 && out.stdout.trim()) {

42 return out.stdout.trim().split(/\r?\n/)[0] ?? candidate;

43 }

44 }

45 catch {

46 /* try next */

47 }

48 }

49 return null;

50}

51/** Install Ollama on Linux/macOS when missing (official install script). */

52export async function installOllama() {

53 if (process.platform === "win32") {

54 throw new Error("Ollama is not installed.\n" +

55 " 1. Download from https://ollama.com/download\n" +

56 " 2. Install, then open Ollama from the Start menu\n" +

57 " 3. Re-run this worker");

58 }

59 if (process.env.GRIDLOCK_SKIP_OLLAMA_INSTALL === "true") {

60 throw new Error("Ollama is not installed. Set GRIDLOCK_SKIP_OLLAMA_INSTALL=false or install from https://ollama.com/download");

61 }

62 workerLog("Ollama not found — installing via https://ollama.com/install.sh …");

63 const result = spawnSync("sh", ["-c", "curl -fsSL https://ollama.com/install.sh | sh"], {

64 stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ollama.jsView on unpkg · L54

65 });

66 if (result.status !== 0) {

67 throw new Error("Ollama install failed. Install manually: curl -fsSL https://ollama.com/install.sh | sh");

68 }

69}

70export async function resolveOllamaBinary() {

71 const existing = findOllamaBinary();

72 if (existing)

73 return existing;

74 await installOllama();