registry / @jacobbd/relay-ai / 0.4.6

@jacobbd/relay-ai@0.4.6

Relay any model into any coding agent — launch Claude Code, Codex, and more with multi-provider gateways

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 935 KB of source, external domains: 127.0.0.1, accounts.google.com, aistudio.google.com, antigravity.google, api.anthropic.com, api.cerebras.ai, api.cohere.com, api.deepinfra.com, api.deepseek.com, api.example.com, api.github.com, api.githubcopilot.com, api.groq.com, api.kilo.ai, api.kimi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.together.xyz, api.venice.ai, api.x.ai, app.kilo.ai, auth.openai.com, auth.x.ai, build.nvidia.com, cdn.simpleicons.org, chatgpt.com, claude.ai, cloud.cerebras.ai, cloudcode-pa.googleapis.com, codeassist.google.com, console.anthropic.com, console.groq.com, console.mistral.ai, console.x.ai, daily-cloudcode-pa.googleapis.com, daily-cloudcode-pa.sandbox.googleapis.com, dashboard.cohere.com, dashscope.aliyuncs.com, dashscope.console.aliyun.com, deepinfra.com, developers.openai.com, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, models.dev, my-proxy.example.com, oauth2.googleapis.com

Oversized source lightweight scan

dist/chunk-YM6G7BHE.js2.54 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsNativeBindingsCryptoShellWebSocketDynamicRequireHighEntropyStringsUrlStrings127.0.0.1accounts.google.comapi.anthropic.comapi.example.comapi.github.comapi.openai.comapi.x.aiauth.openai.comauth.x.aichatgpt.comclaude.aicloudcode-pa.googleapis.comdaily-cloudcode-pa.googleapis.comdaily-cloudcode-pa.sandbox.googleapis.comdevelopers.openai.comgithub.commodels.devoauth2.googleapis.comopencode.aiplatform.claude.comregistry.npmjs.orgrequesty.airouter.requesty.aiwww.googleapis.com

Source & flagged code

6 flagged

dist/cli.jsView file

Lines 268-308javascript

268 if (reason === "placeholder-key") return "placeholder-key";

269 if (reason === "invalid-key") return "invalid-key";

270 return "no-api-key";

271}

272async function keyHint(providerId, authRef, opts) {

273 if (opts?.oauth) return "Signed in via OAuth (OpenCode)";

274 const fromStore = await resolveProviderCredential(providerId, authRef);

275 const key = fromStore ?? opts?.fallbackKey ?? "";

276 if (!key) return "no key";

277 if (key.length <= 5) return "\xB7\xB7\xB7\xB7" + key;

278 return "\xB7\xB7\xB7\xB7" + key.slice(-5);

279}

280async function importFromOpencode(options = {}) {

281 const raw = await fetchRawOpencodeProviders();

282 if (raw === null) {

283 return {

284 imported: [],

285 skipped: [],

286 keysSkipped: [],

287 keysSaved: 0,

288 oauthImported: 0,

289 error: "OpenCode CLI not found or failed to start. Install from https://opencode.ai"

290 };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L288

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L288

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L288

291 }

292 const authFile = readOpencodeAuthFile();

293 const authEntries = authFile?.entries ?? {};

294 const { providers: fetched, oauth } = buildImportProviderList(raw, authEntries);

295 const registry = loadRegistry();

296 migrateLegacyCloudProviders(registry);

297 const imported = [];

298 const skipped = [];

299 const keysSkipped = [];

300 let keysSaved = 0;

301 let oauthImported = 0;

302 const importedIds = /* @__PURE__ */ new Set();

303 for (const lp of fetched) {

304 if (!lp.models.length) {

305 skipped.push({ id: lp.id, name: lp.name, reason: "no-models" });

306 continue;

307 }

308 const isOAuth = isOAuthImportProvider(lp.id, oauth);

Lines 1172-1212javascript

1172${pc4.bold("Usage:")}

1173 relay-ai providers

1174 relay-ai providers add

1175 relay-ai providers import

1176 relay-ai providers list

1177 relay-ai providers remove <id>

1178 relay-ai providers refresh-models [id]

1179 relay-ai providers auth <id> [--native|--broker]

1180

1181${pc4.bold("Subcommands:")}

1182

dist/chunk-YM6G7BHE.jsView file

•path = dist/chunk-YM6G7BHE.js kind = oversized_source_file sizeBytes = 2665088 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-YM6G7BHE.jsView on unpkg

•path = dist/chunk-YM6G7BHE.js kind = oversized_cli_entrypoint sizeBytes = 2665088 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/chunk-YM6G7BHE.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/cli.jsView file

288oauthImported: 0, L289: error: "OpenCode CLI not found or failed to start. Install from https://opencode.ai" L290: }; ... L398: import { homedir } from "os"; L399: import { spawnSync } from "child_process"; L400: function detectShellProfile() { L401: const shell = process.env["SHELL"] ?? ""; L402: if (process.platform === "darwin") { L403: if (shell.includes("zsh")) return { display: "~/.zshrc", path: `${homedir()}/.zshrc` }; L404: if (shell.includes("bash")) return { display: "~/.bash_profile", path: `${homedir()}/.bash_profile` }; ... L671: oauthAccountId: lp.oauthAccountId, L672: providerData: lp.providerData,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L288

1192} L1193: async function runProvidersImport() { L1194: const registry = loadRegistry();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1192

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L288

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L288

dist/chunk-YM6G7BHE.jsView file

•path = dist/chunk-YM6G7BHE.js kind = oversized_source_file sizeBytes = 2665088 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-YM6G7BHE.jsView on unpkg

•path = dist/chunk-YM6G7BHE.js kind = oversized_cli_entrypoint sizeBytes = 2665088 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/chunk-YM6G7BHE.jsView on unpkg

Findings

2 High6 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/cli.js

HighOversized Source Filedist/chunk-YM6G7BHE.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumOversized Cli Entrypointdist/chunk-YM6G7BHE.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/cli.jsView file

Lines 268-308javascript

268 if (reason === "placeholder-key") return "placeholder-key";

269 if (reason === "invalid-key") return "invalid-key";

270 return "no-api-key";

271}

272async function keyHint(providerId, authRef, opts) {

273 if (opts?.oauth) return "Signed in via OAuth (OpenCode)";

274 const fromStore = await resolveProviderCredential(providerId, authRef);

275 const key = fromStore ?? opts?.fallbackKey ?? "";

276 if (!key) return "no key";

277 if (key.length <= 5) return "\xB7\xB7\xB7\xB7" + key;

278 return "\xB7\xB7\xB7\xB7" + key.slice(-5);

279}

280async function importFromOpencode(options = {}) {

281 const raw = await fetchRawOpencodeProviders();

282 if (raw === null) {

283 return {

284 imported: [],

285 skipped: [],

286 keysSkipped: [],

287 keysSaved: 0,

288 oauthImported: 0,

289 error: "OpenCode CLI not found or failed to start. Install from https://opencode.ai"

290 };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L288

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L288

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L288

291 }

292 const authFile = readOpencodeAuthFile();

293 const authEntries = authFile?.entries ?? {};

294 const { providers: fetched, oauth } = buildImportProviderList(raw, authEntries);

295 const registry = loadRegistry();

296 migrateLegacyCloudProviders(registry);

297 const imported = [];

298 const skipped = [];

299 const keysSkipped = [];

300 let keysSaved = 0;

301 let oauthImported = 0;

302 const importedIds = /* @__PURE__ */ new Set();

303 for (const lp of fetched) {

304 if (!lp.models.length) {

305 skipped.push({ id: lp.id, name: lp.name, reason: "no-models" });

306 continue;

307 }

308 const isOAuth = isOAuthImportProvider(lp.id, oauth);

Lines 1172-1212javascript

1172${pc4.bold("Usage:")}

1173 relay-ai providers

1174 relay-ai providers add

1175 relay-ai providers import

1176 relay-ai providers list

1177 relay-ai providers remove <id>

1178 relay-ai providers refresh-models [id]

1179 relay-ai providers auth <id> [--native|--broker]

1180

1181${pc4.bold("Subcommands:")}

1182

dist/chunk-YM6G7BHE.jsView file

•path = dist/chunk-YM6G7BHE.js kind = oversized_source_file sizeBytes = 2665088 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunk-YM6G7BHE.jsView on unpkg

•path = dist/chunk-YM6G7BHE.js kind = oversized_cli_entrypoint sizeBytes = 2665088 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/chunk-YM6G7BHE.jsView on unpkg