registry / @machinen/runtime / 0.8.1

@machinen/runtime@0.8.1

The TypeScript API behind machinen. Reach for this when you want to drive microVMs from your own Node.js code instead of through the CLI.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Calling VM boot with networking and no existing gvproxy can fetch and execute a remote helper. This is package-aligned runtime behavior, but the fetched executable is not integrity-verified.

Static reason

One or more suspicious static signals were detected.

Trigger

User code invokes the runtime's VM boot/networking path without a local gvproxy binary.

Impact

A compromised upstream release asset could execute with the invoking user's privileges.

Mechanism

Runtime download, chmod, and spawn of gvproxy

Rationale

No malicious install-time behavior or data theft was found. Warn because runtime remote executable acquisition lacks visible integrity verification and executes with caller privileges.

Evidence

package.jsondist/index.jsREADME.mdAPI.md~/.machinen/gvproxy/v0.8.6/gvproxy

Network endpoints1

github.com/containers/gvisor-tap-vsock/releases/download/${GVPROXY_VERSION}/${assetName}

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` downloads a platform-specific `gvproxy` binary at runtime.
Downloaded bytes are written under `~/.machinen`, chmod 0755, then spawned.
The download URL has no visible checksum or signature verification.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
Network download is reachable from explicit VM boot/networking behavior, not import time.
Process, filesystem, and guest command APIs align with a microVM runtime.
No credential harvesting, exfiltration, AI-agent config mutation, or stealth persistence found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 398 KB of source, external domains: github.com, json-schema.org, machinen.dev

Source & flagged code

4 flagged

dist/index.jsView file

Lines 470-518javascript

470 return;

471 }

472 for (const r of rows) {

473 this.print(` ${r.id}

474`);

475 }

476 }

477 bannerText() {

478 return `machinen supervisor \u2014 commands start with '${this.prefix}'

479 /ls list sandboxes

480 /attach <id> forward terminal to/from a sandbox (Ctrl-] Ctrl-] to detach)

481 /quit stop the supervisor

482 /help show this message

483`;

484 }

485 print(msg) {

486 this.output.write(msg);

487 }

488};

489

490// src/pty.ts

491import { spawn } from "child_process";

492import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L490

493

494// src/native/pty.ts

495import { existsSync } from "fs";

496import { createRequire } from "module";

497import { arch, platform } from "os";

498var PTY_NAME = "machinen-pty";

499var require_ = createRequire(import.meta.url);

500function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L498

501 return resolvePtyShimEnvOverride() ?? findBundledPtyShim() ?? missingPtyShim();

502}

503function resolvePtyShimEnvOverride() {

504 const envOverride = process.env.MACHINEN_PTY;

505 if (!envOverride) {

506 return void 0;

507 }

508 if (existsSync(envOverride)) {

509 return envOverride;

510 }

511 throw new BootError(

512 "BOOT_VMM_PACKAGE_BROKEN",

513 `MACHINEN_PTY=${envOverride} is set but that file does not exist.`

514 );

515}

516function findBundledPtyShim() {

517 const pkg = `@machinen/native-${arch()}-${platform()}`;

518 try {

Lines 980-1020javascript

980 sock.on("error", fail);

981 sock.on("data", (chunk) => tar.stdin.write(chunk));

982 sock.on("end", () => tar.stdin.end());

983 sock.on("close", () => tar.stdin.end());

984 tar.on("exit"

Lines 6620-6660javascript

6620 describePortHolder(opts.hostPort).catch(() => null).then((holder) => {

6621 const hint = holder ? ` (${holder})` : " (set by another process \u2014 try `lsof -nP -iTCP:" + opts.hostPort + "`)";

6622

Source & flagged code

4 flagged · loading source

dist/index.jsView file

490// src/pty.ts L491: import { spawn } from "child_process"; L492: import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L490

1000* Run `cmd` inside the guest via the exec-agent. The command string L1001: * is passed verbatim to `sh -c` inside the guest, so shell syntax L1002: * (pipes, redirection, env) works.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1000

6640req.once("error", fail); L6641: req.write(body); L6642: req.end(); ... L6649: warnedMissing = true; L6650: process.stderr.write( L6651: "machinen: gvproxy not found \u2014 microVM networking is disabled.\n Install: https://github.com/containers/gvisor-tap-vsock/releases\n Or point MACHINEN_GVPROXY at the binary d... L6652: ); ... L6655: // src/nested-virt.ts L6656: import { spawnSync as spawnSync2 } from "child_process"; L6657:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L6640

498var PTY_NAME = "machinen-pty"; L499: var require_ = createRequire(import.meta.url); L500: function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L498

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 470-518javascript

470 return;

471 }

472 for (const r of rows) {

473 this.print(` ${r.id}

474`);

475 }

476 }

477 bannerText() {

478 return `machinen supervisor \u2014 commands start with '${this.prefix}'

479 /ls list sandboxes

480 /attach <id> forward terminal to/from a sandbox (Ctrl-] Ctrl-] to detach)

481 /quit stop the supervisor

482 /help show this message

483`;

484 }

485 print(msg) {

486 this.output.write(msg);

487 }

488};

489

490// src/pty.ts

491import { spawn } from "child_process";

492import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L490

493

494// src/native/pty.ts

495import { existsSync } from "fs";

496import { createRequire } from "module";

497import { arch, platform } from "os";

498var PTY_NAME = "machinen-pty";

499var require_ = createRequire(import.meta.url);

500function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L498

501 return resolvePtyShimEnvOverride() ?? findBundledPtyShim() ?? missingPtyShim();

502}

503function resolvePtyShimEnvOverride() {

504 const envOverride = process.env.MACHINEN_PTY;

505 if (!envOverride) {

506 return void 0;

507 }

508 if (existsSync(envOverride)) {

509 return envOverride;

510 }

511 throw new BootError(

512 "BOOT_VMM_PACKAGE_BROKEN",

513 `MACHINEN_PTY=${envOverride} is set but that file does not exist.`

514 );

515}

516function findBundledPtyShim() {

517 const pkg = `@machinen/native-${arch()}-${platform()}`;

518 try {

Lines 980-1020javascript

980 sock.on("error", fail);

981 sock.on("data", (chunk) => tar.stdin.write(chunk));

982 sock.on("end", () => tar.stdin.end());

983 sock.on("close", () => tar.stdin.end());

984 tar.on("exit"

Lines 6620-6660javascript

6620 describePortHolder(opts.hostPort).catch(() => null).then((holder) => {

6621 const hint = holder ? ` (${holder})` : " (set by another process \u2014 try `lsof -nP -iTCP:" + opts.hostPort + "`)";

6622