registry / @inorainllc/wellyon / 0.2.0

@inorainllc/wellyon@0.2.0

Wellyon server monitoring agent — streams host metrics and database statistics to your Wellyon server widget. DB credentials never leave your server.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 69.7 KB of source, external domains: api.wellyon.ai

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 14-54javascript

14Usage: wellyon-server-agent <command>

16Commands:

17 init Interactive setup — writes wellyon-agent.json and enrolls this server

18 start Run the agent (default when a config exists)

19 test-connection Check Wellyon + database connectivity and exit

20 help Show this help

22Config file lookup: $WELLYON_CONFIG → ./wellyon-agent.json → ~/.wellyon/agent.json

23Env overrides: WELLYON_ENDPOINT, WELLYON_PAIRING_TOKEN, WELLYON_SERVER_NAME

25Recommended: give the agent a READ-ONLY database user. \`init\` prints the GRANT

26statements for your engine.`;

27function ask(rl, question, fallback = '') {

28 return new Promise((resolve) => {

29 rl.question(fallback ? `${question} [${fallback}]: ` : `${question}: `, (answer) => {

30 resolve(answer.trim() || fallback);

31 });

32 });

33}

34async function init() {

35 const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout });

36 console.log(`\nWellyon server agent setup\n${'-'.repeat(30)}`);

37 const endpoint = await ask(rl, 'Wellyon API endpoint', process.env.WELLYON_ENDPOINT || 'https://api.wellyon.ai');

38 const pairingToken = await ask(rl, 'Pairing token (from the dashboard, starts with wsa_)', process.env.WELLYON_PAIRING_TOKEN || '');

39 const serverName = await ask(rl, 'Server name', os_1.default.hostname());

40 const databases = [];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L34

41 for (;;) {

42 const add = (await ask(rl, databases.length ? 'Add another database? (y/N)' : 'Add a database? (Y/n)', databases.length ? 'n' : 'y')).toLowerCase();

43 if (add !== 'y')

44 break;

45 const id = await ask(rl, ' Database id (short label, e.g. "main")', `db${databases.length + 1}`);

46 const kind = (await ask(rl, ' Kind (postgres / mysql / mariadb)', 'postgres')).toLowerCase();

47 const url = await ask(rl, ' Connection URL (leave empty for discrete fields)');

48 let db;

49 if (url) {

50 db = { id, kind, url };

51 }

52 else {

53 const host = await ask(rl, ' Host', 'localhost');

54 const port = Number(await ask(rl, ' Port', kind === 'postgres' ? '5432' : '3306'));

Source & flagged code

1 flagged · loading source

dist/cli.jsView file

34async function init() { L35: const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout }); L36: console.log(`\nWellyon server agent setup\n${'-'.repeat(30)}`); L37: const endpoint = await ask(rl, 'Wellyon API endpoint', process.env.WELLYON_ENDPOINT || 'https://api.wellyon.ai'); L38: const pairingToken = await ask(rl, 'Pairing token (from the dashboard, starts with wsa_)', process.env.WELLYON_PAIRING_TOKEN || ''); L39: const serverName = await ask(rl, 'Server name', os_1.default.hostname()); L40: const databases = [];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L34

Findings

1 High2 Medium4 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

1 flagged

dist/cli.jsView file

Lines 14-54javascript

14Usage: wellyon-server-agent <command>

16Commands:

17 init Interactive setup — writes wellyon-agent.json and enrolls this server

18 start Run the agent (default when a config exists)

19 test-connection Check Wellyon + database connectivity and exit

20 help Show this help

22Config file lookup: $WELLYON_CONFIG → ./wellyon-agent.json → ~/.wellyon/agent.json

23Env overrides: WELLYON_ENDPOINT, WELLYON_PAIRING_TOKEN, WELLYON_SERVER_NAME

25Recommended: give the agent a READ-ONLY database user. \`init\` prints the GRANT

26statements for your engine.`;

27function ask(rl, question, fallback = '') {

28 return new Promise((resolve) => {

29 rl.question(fallback ? `${question} [${fallback}]: ` : `${question}: `, (answer) => {

30 resolve(answer.trim() || fallback);

31 });

32 });

33}

34async function init() {

35 const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout });

36 console.log(`\nWellyon server agent setup\n${'-'.repeat(30)}`);

37 const endpoint = await ask(rl, 'Wellyon API endpoint', process.env.WELLYON_ENDPOINT || 'https://api.wellyon.ai');

38 const pairingToken = await ask(rl, 'Pairing token (from the dashboard, starts with wsa_)', process.env.WELLYON_PAIRING_TOKEN || '');

39 const serverName = await ask(rl, 'Server name', os_1.default.hostname());

40 const databases = [];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L34

41 for (;;) {

42 const add = (await ask(rl, databases.length ? 'Add another database? (y/N)' : 'Add a database? (Y/n)', databases.length ? 'n' : 'y')).toLowerCase();

43 if (add !== 'y')

44 break;

45 const id = await ask(rl, ' Database id (short label, e.g. "main")', `db${databases.length + 1}`);

46 const kind = (await ask(rl, ' Kind (postgres / mysql / mariadb)', 'postgres')).toLowerCase();

47 const url = await ask(rl, ' Connection URL (leave empty for discrete fields)');

48 let db;

49 if (url) {

50 db = { id, kind, url };

51 }

52 else {

53 const host = await ask(rl, ' Host', 'localhost');

54 const port = Number(await ask(rl, ' Port', kind === 'postgres' ? '5432' : '3306'));