registry / @intrect/openswarm / 0.13.0

@intrect/openswarm@0.13.0

⚠ Under review

Autonomous AI agent orchestrator — Claude, GPT, Codex, and local models (Ollama/LMStudio/llama.cpp)

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 214 file(s), 1.92 MB of source, external domains: 127.0.0.1, api.cryptoquant.com, api.linear.app, api.openai.com, api.search.brave.com, api.tavily.com, api.telegram.org, auth.openai.com, chatgpt.com, docs.anthropic.com, github.com, html.duckduckgo.com, linear.app, mcp.linear.app, openrouter.ai, telemetry.intrect.io

Source & flagged code

4 flagged

dist/registry/bsDetector.jsView file

Lines 98-138javascript

98 severity: 'warning',

99 category: 'type_safety',

100 message: ': any 타입 사용 — 타입 안전성 부재',

101 pattern: /:\s*any\b(?!\[)/,

102 languages: ['typescript'],

103 excludeIf: (line, fp) => isTestPath(fp) || /eslint-disable/.test(line) || /\/\//.test(line.split(':')[0] ?? '') ||

104 /function\s+normalize|parsed:\s*any|JSON\.parse|response\.\w+\.map/.test(line), // JSON 파싱 결과 접근 패턴

105 },

106 // non-null assertion

107 {

108 severity: 'warning',

109 category: 'type_safety',

110 message: 'non-null assertion (!) — null 체크 없이 단언',

111 pattern: /\w+!\./,

112 languages: ['typescript'],

113 excludeIf: (_line, fp) => isTestPath(fp),

114 },

115 // eval 사용

116 {

117 severity: 'warning',

118 category: 'security',

119 message: 'eval() 사용 — 코드 인젝션 위험',

120 pattern: /\beval\s*\(/,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/registry/bsDetector.jsView on unpkg · L118

121 excludeIf: (_line, fp) => isTestPath(fp),

122 },

123 // fake API / example.com

124 {

125 severity: 'warning',

126 category: 'fake_data',

127 message: 'example.com 등 가짜 URL — 실 운영 불가',

128 pattern: /(?:example\.com|localhost:\d{4}|127\.0\.0\.1:\d{4})/,

129 excludeIf: (line, fp) => isTestPath(fp) || /\/\//.test(line.split('http')[0] ?? '') || /config|env|default|Html\.ts|linear|github/i.test(fp) || /config|env

130 },

131 // ============ MINOR ============

132 // 매직 넘버

133 {

134 severity: 'minor',

135 category: 'magic_number',

136 message: '매직 넘버 — 의미 불명확한 하드코딩 숫자',

137 pattern: /(?:=|return|>|<|===|!==)\s*(?:(?!0\b|1\b|2\b|-1\b|100\b|1000\b|60\b|24\b|365\b)\d{3,})\b/,

138 excludeIf: (line, fp) => isTestPath(fp) || /const|timeout|limit|max|min|port|size|width|height|delay|interval|ms|sec/i.test(line),

dist/cli/doctorHandler.jsView file

Lines 30-70javascript

30 const srv = createServer();

31 srv.once('error', () => resolve(false));

32 srv.once('listening', () => srv.close(() => resolve(true)));

dist/auth/openrouterPkce.jsView file

Lines 1-25javascript

1// ============================================

2// OpenSwarm - OpenRouter PKCE Flow

3// Browser-based login that exchanges an authorization code

4// for a user-controlled `sk-or-*` API key.

5// ============================================

6import { createServer } from 'node:http';

7import { randomBytes, createHash } from 'node:crypto';

8import { exec } from 'node:child_process'

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @intrect/openswarm@0.11.0 matchedIdentity = npm:QGludHJlY3Qvb3BlbnN3YXJt:0.11.0 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/registry/bsDetector.jsView file

118category: 'security', L119: message: 'eval() 사용 — 코드 인젝션 위험', L120: pattern: /\beval\s*\(/,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/registry/bsDetector.jsView on unpkg · L118

dist/cli/doctorHandler.jsView file

50try { L51: await import(mod); L52: line('ok', `native: ${mod}`, 'loads');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/doctorHandler.jsView on unpkg · L50

dist/auth/openrouterPkce.jsView file

5// ============================================ L6: import { createServer } from 'node:http'; L7: import { randomBytes, createHash } from 'node:crypto'; L8: import { exec } from 'node:child_process'; L9: import { AuthProfileStore } from './oauthStore.js'; ... L18: function generateCodeVerifier() { L19: return randomBytes(96).toString('base64url'); L20: } ... L28: function openBrowser(url) { L29: const platform = process.platform; L30: const cmd = platform === 'darwin' ? 'open' : ... L57: const state = generateState();

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/auth/openrouterPkce.jsView on unpkg · L5

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

Findings

1 Critical1 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighSandbox Evasion Gated Capabilitydist/auth/openrouterPkce.js

MediumDynamic Requiredist/cli/doctorHandler.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/registry/bsDetector.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/registry/bsDetector.jsView file

Lines 98-138javascript

98 severity: 'warning',

99 category: 'type_safety',

100 message: ': any 타입 사용 — 타입 안전성 부재',

101 pattern: /:\s*any\b(?!\[)/,

102 languages: ['typescript'],

103 excludeIf: (line, fp) => isTestPath(fp) || /eslint-disable/.test(line) || /\/\//.test(line.split(':')[0] ?? '') ||

104 /function\s+normalize|parsed:\s*any|JSON\.parse|response\.\w+\.map/.test(line), // JSON 파싱 결과 접근 패턴

105 },

106 // non-null assertion

107 {

108 severity: 'warning',

109 category: 'type_safety',

110 message: 'non-null assertion (!) — null 체크 없이 단언',

111 pattern: /\w+!\./,

112 languages: ['typescript'],

113 excludeIf: (_line, fp) => isTestPath(fp),

114 },

115 // eval 사용

116 {

117 severity: 'warning',

118 category: 'security',

119 message: 'eval() 사용 — 코드 인젝션 위험',

120 pattern: /\beval\s*\(/,

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/registry/bsDetector.jsView on unpkg · L118

121 excludeIf: (_line, fp) => isTestPath(fp),

122 },

123 // fake API / example.com

124 {

125 severity: 'warning',

126 category: 'fake_data',

127 message: 'example.com 등 가짜 URL — 실 운영 불가',

128 pattern: /(?:example\.com|localhost:\d{4}|127\.0\.0\.1:\d{4})/,

129 excludeIf: (line, fp) => isTestPath(fp) || /\/\//.test(line.split('http')[0] ?? '') || /config|env|default|Html\.ts|linear|github/i.test(fp) || /config|env

130 },

131 // ============ MINOR ============

132 // 매직 넘버

133 {

134 severity: 'minor',

135 category: 'magic_number',

136 message: '매직 넘버 — 의미 불명확한 하드코딩 숫자',

137 pattern: /(?:=|return|>|<|===|!==)\s*(?:(?!0\b|1\b|2\b|-1\b|100\b|1000\b|60\b|24\b|365\b)\d{3,})\b/,

138 excludeIf: (line, fp) => isTestPath(fp) || /const|timeout|limit|max|min|port|size|width|height|delay|interval|ms|sec/i.test(line),

dist/cli/doctorHandler.jsView file

Lines 30-70javascript

30 const srv = createServer();

31 srv.once('error', () => resolve(false));

32 srv.once('listening', () => srv.close(() => resolve(true)));

dist/auth/openrouterPkce.jsView file

Lines 1-25javascript

1// ============================================

2// OpenSwarm - OpenRouter PKCE Flow

3// Browser-based login that exchanges an authorization code

4// for a user-controlled `sk-or-*` API key.

5// ============================================

6import { createServer } from 'node:http';

7import { randomBytes, createHash } from 'node:crypto';

8import { exec } from 'node:child_process'

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg