registry / @jiayunxie/aerial / 0.3.2

@jiayunxie/aerial@0.3.2

Local GitHub Copilot proxy for Codex CLI and Claude Code with smart HTTP(S)/SOCKS5 upstream proxy support.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 205 KB of source, external domains: 127.0.0.1, aerial.local, api.github.com, api.githubcopilot.com, github.com, ipinfo.io

Source & flagged code

1 flagged

src/upstream/fetch.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { ProxyAgent } from "undici";

3import { loadConfig, saveConfig } from "../shared/config.js";

4import { PROXY_MODE_AUTO, PROXY_MODE_DISABLED, isSocksProxyEndpoint, normalizeProxyEndpoint, normalizeProxyMode } from "./proxy-config.js";

5import { startSocks5Bridge, _closeSocks5BridgesForTests } from "./socks5-bridge.js";

7const VALIDATION_URL = "https://api.github.com/rate_limit";

8const EGRESS_URL = "https://ipinfo.io/json";

9const DEFAULT_TIMEOUT_MS = 5000;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/upstream/fetch.jsView on unpkg · L1

10const MAX_PAC_BYTES = 1024 * 1024;

11const COMMON_LOCAL_HTTP_PROXY_PORTS = Object.freeze([

12 1087,

13 7890,

14 7897,

15 7899,

16 6152,

17 10808,

18 10809

19]);

20const COMMON_LOCAL_SOCKS_PROXY_PORTS = Object.freeze([

21 1086,

Source & flagged code

1 flagged · loading source

src/upstream/fetch.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code