registry / @konglx/rotom / 3.0.2

@konglx/rotom@3.0.2

Digital Employee Mesh — Enterprise agent collaboration network (rotom CLI)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 161 file(s), 4.78 MB of source, external domains: 127.0.0.1, api.dicebear.com, bugzilla.mozilla.org, cdn.jsdelivr.net, code.google.com, code.visualstudio.com, developer.mozilla.org, developers.google.com, drafts.csswg.org, en.wikipedia.org, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, json-schema.org, r12a.github.io, reactjs.org, sass-lang.com, schema.org, stackoverflow.com, support.google.com, tools.ietf.org, wiki.whatwg.org, www.apache.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org

Oversized source lightweight scan

dist/master/dashboard/assets/monaco-core-oQiQUisy.js2.43 MB file, sampled 256 KB

ChildProcessHighEntropyStringsMinifiedUrlStringscode.visualstudio.comgithub.com

dist/master/dashboard/assets/ts.worker-BhkL8olL.js5.74 MB file, sampled 256 KB

FilesystemNetworkUrlStringswww.apache.org

Source & flagged code

7 flagged

package.jsonView file

Lines 12-52json

12 "link": "CI=1 pnpm link --global . --yes",

13 "build:master": "tsc && pnpm dashboard:build && rm -rf dist/master/dashboard && cp -r packages/dashboard/dist/src/master/dashboard dist/master/dashboard && cp src/executor/claude-code-hook.cjs dist/executor/claude-code-hook.cjs",

14 "master": "bash bin/mesh-master.sh start",

15 "master:start": "bash bin/mesh-master.sh start --daemon",

16 "master:stop": "bash bin/mesh-master.sh stop",

17 "master:restart": "bash bin/mesh-master.sh restart --daemon",

18 "master:status": "bash bin/mesh-master.sh status",

19 "start": "bash bin/rotom-up.sh start",

20 "stop": "bash bin/rotom-up.sh stop",

21 "restart": "bash bin/rotom-up.sh restart",

22 "status": "bash bin/rotom-up.sh status",

23 "logs": "bash bin/rotom-up.sh logs",

24 "dashboard:dev": "pnpm --filter @a2a-gateway/dashboard dev",

25 "dashboard:build": "pnpm --filter @a2a-gateway/dashboard build",

26 "dashboard:preview": "pnpm --filter @a2a-gateway/dashboard preview",

27 "website:dev": "pnpm --filter @konglx/rotom-website dev",

28 "website:build": "pnpm --filter @konglx/rotom-website build",

29 "website:preview": "pnpm --filter @konglx/rotom-website preview",

30 "executor": "node --import tsx src/executor/index.ts",

31 "test": "node --import tsx --test tests/*.test.ts",

32 "postinstall": "node scripts/fix-node-pty-perms.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "express": "^4.21.2",

36 "jsonwebtoken": "^9.0.2",

37 "ws": "^8.18.0"

38 },

39 "files": [

40 "bin",

41 "dist/master",

42 "dist/executor",

43 "dist/link",

44 "dist/cli",

45 "dist/shared",

46 "migrations",

47 "scripts",

48 "skill"

49 ],

50 "optionalDependencies": {

51 "better-sqlite3": "^11.0.0",

52 "node-pty": "^1.0.0"

dist/cli/join.jsView file

Lines 17-57javascript

17import { masterFetch, masterHttpBase, masterWsBase } from "./routes.js";

18const DEFAULT_PORT = 28800;

19function parseMasterSpec(spec) {

20 let s = spec.trim().replace(/^ws:\/\//,

dist/master/repo-scan.jsView file

Lines 1-37javascript

1/**

2 * Master 侧的 worktree 扫描(只读)。

3 *

4 * worktree 物理上在 executor 本机(`~/.rotom/repos/`),但 master 与 executor

5 * 同机部署时可直接读 FS 暴露给 Dashboard。跨机器时本模块返回空列表(本机无缓存)。

6 *

7 * 不依赖 executor/repo-cache.ts(那是 executor 侧 spawn git 的模块),这里独立

8 * 实现 scan 逻辑,保持 master/executor 模块边界清晰。算法与 repo-cache 一致:

9 * - repoId = SHA-1(归一化 URL) 前 12 位

10 * - repoName = URL 最后一段(去 .git)

11 * - bare 目录名 = <repoName>-<repoId8>.git

12 * - worktree 根 = <repoName>-<repoId8>-wt/<slot>/

bin/rotom-up.shView file

•path = bin/rotom-up.sh kind = build_helper sizeBytes = 14370 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/rotom-up.shView on unpkg

dist/master/dashboard/favicon.icoView file

•path = dist/master/dashboard/favicon.ico kind = high_entropy_blob sizeBytes = 9316 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/master/dashboard/favicon.icoView on unpkg

dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView file

•path = dist/master/dashboard/assets/ts.worker-BhkL8olL.js kind = oversized_source_file sizeBytes = 6023473 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView on unpkg

dist/cli/run.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @konglx/rotom@3.0.0 matchedIdentity = npm:QGtvbmdseC9yb3RvbQ:3.0.0 similarity = 0.850 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/run.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty-perms.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli/join.jsView file

37try { L38: const { execSync } = require("node:child_process"); L39: const p = execSync(`command -v ${tool}`, { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/join.jsView on unpkg · L37

dist/master/repo-scan.jsView file

17import { createHash } from "node:crypto"; L18: import { spawnSync } from "node:child_process"; L19: import fs from "node:fs"; ... L21: import path from "node:path"; L22: const REPOS_ROOT = path.join(os.homedir(), ".rotom", "repos"); L23: export function repoIdFor(url) { ... L62: ok: r.status === 0, L63: stdout: typeof r.stdout === "string" ? r.stdout : "", L64: stderr: typeof r.stderr === "string" ? r.stderr : "", ... L166: try { L167: const parsed = JSON.parse(group.extra_repos); L168: if (Array.isArray(parsed)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/master/repo-scan.jsView on unpkg · L17

bin/rotom-up.shView file

•path = bin/rotom-up.sh kind = build_helper sizeBytes = 14370 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/rotom-up.shView on unpkg

dist/master/dashboard/favicon.icoView file

•path = dist/master/dashboard/favicon.ico kind = high_entropy_blob sizeBytes = 9316 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/master/dashboard/favicon.icoView on unpkg

dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView file

•path = dist/master/dashboard/assets/ts.worker-BhkL8olL.js kind = oversized_source_file sizeBytes = 6023473 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView on unpkg

dist/cli/run.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/run.jsView on unpkg

Findings

4 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist/master/dashboard/favicon.ico

HighOversized Source Filedist/master/dashboard/assets/ts.worker-BhkL8olL.js

HighPrevious Version Dangerous Deltadist/cli/run.js

MediumDynamic Requiredist/cli/join.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/rotom-up.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/master/repo-scan.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

package.jsonView file

Lines 12-52json

12 "link": "CI=1 pnpm link --global . --yes",

14 "master": "bash bin/mesh-master.sh start",

15 "master:start": "bash bin/mesh-master.sh start --daemon",

16 "master:stop": "bash bin/mesh-master.sh stop",

17 "master:restart": "bash bin/mesh-master.sh restart --daemon",

18 "master:status": "bash bin/mesh-master.sh status",

19 "start": "bash bin/rotom-up.sh start",

20 "stop": "bash bin/rotom-up.sh stop",

21 "restart": "bash bin/rotom-up.sh restart",

22 "status": "bash bin/rotom-up.sh status",

23 "logs": "bash bin/rotom-up.sh logs",

24 "dashboard:dev": "pnpm --filter @a2a-gateway/dashboard dev",

25 "dashboard:build": "pnpm --filter @a2a-gateway/dashboard build",

26 "dashboard:preview": "pnpm --filter @a2a-gateway/dashboard preview",

27 "website:dev": "pnpm --filter @konglx/rotom-website dev",

28 "website:build": "pnpm --filter @konglx/rotom-website build",

29 "website:preview": "pnpm --filter @konglx/rotom-website preview",

30 "executor": "node --import tsx src/executor/index.ts",

31 "test": "node --import tsx --test tests/*.test.ts",

32 "postinstall": "node scripts/fix-node-pty-perms.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 },

34 "dependencies": {

35 "express": "^4.21.2",

36 "jsonwebtoken": "^9.0.2",

37 "ws": "^8.18.0"

38 },

39 "files": [

40 "bin",

41 "dist/master",

42 "dist/executor",

43 "dist/link",

44 "dist/cli",

45 "dist/shared",

46 "migrations",

47 "scripts",

48 "skill"

49 ],

50 "optionalDependencies": {

51 "better-sqlite3": "^11.0.0",

52 "node-pty": "^1.0.0"

dist/cli/join.jsView file

Lines 17-57javascript

17import { masterFetch, masterHttpBase, masterWsBase } from "./routes.js";

18const DEFAULT_PORT = 28800;

19function parseMasterSpec(spec) {

20 let s = spec.trim().replace(/^ws:\/\//,

dist/master/repo-scan.jsView file

Lines 1-37javascript

1/**

2 * Master 侧的 worktree 扫描(只读)。

3 *

4 * worktree 物理上在 executor 本机(`~/.rotom/repos/`),但 master 与 executor

5 * 同机部署时可直接读 FS 暴露给 Dashboard。跨机器时本模块返回空列表(本机无缓存)。

6 *

7 * 不依赖 executor/repo-cache.ts(那是 executor 侧 spawn git 的模块),这里独立

8 * 实现 scan 逻辑,保持 master/executor 模块边界清晰。算法与 repo-cache 一致:

9 * - repoId = SHA-1(归一化 URL) 前 12 位

10 * - repoName = URL 最后一段(去 .git)

11 * - bare 目录名 = <repoName>-<repoId8>.git

12 * - worktree 根 = <repoName>-<repoId8>-wt/<slot>/

bin/rotom-up.shView file

•path = bin/rotom-up.sh kind = build_helper sizeBytes = 14370 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/rotom-up.shView on unpkg

dist/master/dashboard/favicon.icoView file

•path = dist/master/dashboard/favicon.ico kind = high_entropy_blob sizeBytes = 9316 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/master/dashboard/favicon.icoView on unpkg

dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView file

•path = dist/master/dashboard/assets/ts.worker-BhkL8olL.js kind = oversized_source_file sizeBytes = 6023473 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/master/dashboard/assets/ts.worker-BhkL8olL.jsView on unpkg

dist/cli/run.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/run.jsView on unpkg