registry / @machinen/runtime / 0.7.0

@machinen/runtime@0.7.0

The TypeScript API behind machinen. Reach for this when you want to drive microVMs from your own Node.js code instead of through the CLI.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 399 KB of source, external domains: github.com, json-schema.org, machinen.dev

Source & flagged code

4 flagged

dist/index.jsView file

Lines 468-516javascript

468 return;

469 }

470 for (const r of rows) {

471 this.print(` ${r.id}

472`);

473 }

474 }

475 bannerText() {

476 return `machinen supervisor \u2014 commands start with '${this.prefix}'

477 /ls list sandboxes

478 /attach <id> forward terminal to/from a sandbox (Ctrl-] Ctrl-] to detach)

479 /quit stop the supervisor

480 /help show this message

481`;

482 }

483 print(msg) {

484 this.output.write(msg);

485 }

486};

487

488// src/pty.ts

489import { spawn } from "child_process";

490import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L488

491

492// src/native/pty.ts

493import { existsSync } from "fs";

494import { createRequire } from "module";

495import { arch, platform } from "os";

496var PTY_NAME = "machinen-pty";

497var require_ = createRequire(import.meta.url);

498function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L496

499 return resolvePtyShimEnvOverride() ?? findBundledPtyShim() ?? missingPtyShim();

500}

501function resolvePtyShimEnvOverride() {

502 const envOverride = process.env.MACHINEN_PTY;

503 if (!envOverride) {

504 return void 0;

505 }

506 if (existsSync(envOverride)) {

507 return envOverride;

508 }

509 throw new BootError(

510 "BOOT_VMM_PACKAGE_BROKEN",

511 `MACHINEN_PTY=${envOverride} is set but that file does not exist.`

512 );

513}

514function findBundledPtyShim() {

515 const pkg = `@machinen/native-${arch()}-${platform()}`;

516 try {

Lines 978-1018javascript

978 sock.on("error", fail);

979 sock.on("data", (chunk) => tar.stdin.write(chunk));

980 sock.on("end", () => tar.stdin.end());

981 sock.on("close", () => tar.stdin.end());

982 tar.on("exit"

Lines 6901-6941javascript

6901 describePortHolder(opts.hostPort).catch(() => null).then((holder) => {

6902 const hint = holder ? ` (${holder})` : " (set by another process \u2014 try `lsof -nP -iTCP:" + opts.hostPort + "`)";

6903

Source & flagged code

4 flagged · loading source

dist/index.jsView file

488// src/pty.ts L489: import { spawn } from "child_process"; L490: import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L488

998* Run `cmd` inside the guest via the exec-agent. The command string L999: * is passed verbatim to `sh -c` inside the guest, so shell syntax L1000: * (pipes, redirection, env) works.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L998

6921req.once("error", fail); L6922: req.write(body); L6923: req.end(); ... L6930: warnedMissing = true; L6931: process.stderr.write( L6932: "machinen: gvproxy not found \u2014 microVM networking is disabled.\n Install: https://github.com/containers/gvisor-tap-vsock/releases\n Or point MACHINEN_GVPROXY at the binary d... L6933: ); ... L6936: // src/nested-virt.ts L6937: import { spawnSync as spawnSync2 } from "child_process"; L6938:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L6921

496var PTY_NAME = "machinen-pty"; L497: var require_ = createRequire(import.meta.url); L498: function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L496

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 468-516javascript

468 return;

469 }

470 for (const r of rows) {

471 this.print(` ${r.id}

472`);

473 }

474 }

475 bannerText() {

476 return `machinen supervisor \u2014 commands start with '${this.prefix}'

477 /ls list sandboxes

478 /attach <id> forward terminal to/from a sandbox (Ctrl-] Ctrl-] to detach)

479 /quit stop the supervisor

480 /help show this message

481`;

482 }

483 print(msg) {

484 this.output.write(msg);

485 }

486};

487

488// src/pty.ts

489import { spawn } from "child_process";

490import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L488

491

492// src/native/pty.ts

493import { existsSync } from "fs";

494import { createRequire } from "module";

495import { arch, platform } from "os";

496var PTY_NAME = "machinen-pty";

497var require_ = createRequire(import.meta.url);

498function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L496

499 return resolvePtyShimEnvOverride() ?? findBundledPtyShim() ?? missingPtyShim();

500}

501function resolvePtyShimEnvOverride() {

502 const envOverride = process.env.MACHINEN_PTY;

503 if (!envOverride) {

504 return void 0;

505 }

506 if (existsSync(envOverride)) {

507 return envOverride;

508 }

509 throw new BootError(

510 "BOOT_VMM_PACKAGE_BROKEN",

511 `MACHINEN_PTY=${envOverride} is set but that file does not exist.`

512 );

513}

514function findBundledPtyShim() {

515 const pkg = `@machinen/native-${arch()}-${platform()}`;

516 try {

Lines 978-1018javascript

978 sock.on("error", fail);

979 sock.on("data", (chunk) => tar.stdin.write(chunk));

980 sock.on("end", () => tar.stdin.end());

981 sock.on("close", () => tar.stdin.end());

982 tar.on("exit"

Lines 6901-6941javascript

6901 describePortHolder(opts.hostPort).catch(() => null).then((holder) => {

6902 const hint = holder ? ` (${holder})` : " (set by another process \u2014 try `lsof -nP -iTCP:" + opts.hostPort + "`)";

6903