registry / @machinen/runtime / 0.7.2

@machinen/runtime@0.7.2

The TypeScript API behind machinen. Reach for this when you want to drive microVMs from your own Node.js code instead of through the CLI.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a user-invoked microVM runtime with expected VM process spawning, guest command execution, local cache/registry writes, and optional gvproxy download.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports the library and calls APIs such as boot(), provision(), attach(), exec(), or networking/port-forwarding options.

Impact

Runs configured VMM/helper processes and guest commands requested by the caller; may write Machinen runtime state and cache files.

Mechanism

package-aligned VM orchestration and optional helper download

Rationale

Static inspection shows suspicious primitives are tied to the documented microVM runtime and are activated by explicit API calls, with no lifecycle hook or unconsented control-surface mutation. The optional GitHub gvproxy download and local cache writes are package-aligned runtime behavior rather than malware.

Evidence

package.jsonREADME.mddist/index.jsdist/index.d.tsAPI.md~/.machinen/gvproxy/v0.8.6/gvproxy~/.machinen/vms~/.machinen/logs~/.cache/machinen/rootfs~/.cache/machinen/mountdisk~/.cache/machinen/image-config

Network endpoints1

github.com/containers/gvisor-tap-vsock/releases/download/v0.8.6/<assetName>

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/index.js contains runtime child_process spawn/execFileSync APIs for VMM helpers, tar, sysctl, gvproxy, and guest exec support.
dist/index.js can fetch gvproxy from github.com at runtime if no local gvproxy is found.
dist/index.js writes runtime caches/registry/logs under ~/.machinen and ~/.cache/machinen during VM operations.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks and exports only dist/index.js.
No import-time execution observed beyond definitions/exports; VM, provision, download, and exec paths are user-invoked APIs.
README.md describes a microVM runtime; child_process, guest exec, snapshots, caches, and networking match the package purpose.
No credential harvesting, broad filesystem scanning, exfiltration endpoint, AI-agent control-surface mutation, persistence hook, or destructive install behavior found.
Network endpoint is package-aligned gvproxy dependency download from GitHub releases, not arbitrary command-output exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 398 KB of source, external domains: github.com, json-schema.org, machinen.dev

Source & flagged code

4 flagged

dist/index.jsView file

Lines 470-518javascript

470 return;

471 }

472 for (const r of rows) {

473 this.print(` ${r.id}

474`);

475 }

476 }

477 bannerText() {

478 return `machinen supervisor \u2014 commands start with '${this.prefix}'

479 /ls list sandboxes

480 /attach <id> forward terminal to/from a sandbox (Ctrl-] Ctrl-] to detach)

481 /quit stop the supervisor

482 /help show this message

483`;

484 }

485 print(msg) {

486 this.output.write(msg);

487 }

488};

489

490// src/pty.ts

491import { spawn } from "child_process";

492import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L490

493

494// src/native/pty.ts

495import { existsSync } from "fs";

496import { createRequire } from "module";

497import { arch, platform } from "os";

498var PTY_NAME = "machinen-pty";

499var require_ = createRequire(import.meta.url);

500function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L498

501 return resolvePtyShimEnvOverride() ?? findBundledPtyShim() ?? missingPtyShim();

502}

503function resolvePtyShimEnvOverride() {

504 const envOverride = process.env.MACHINEN_PTY;

505 if (!envOverride) {

506 return void 0;

507 }

508 if (existsSync(envOverride)) {

509 return envOverride;

510 }

511 throw new BootError(

512 "BOOT_VMM_PACKAGE_BROKEN",

513 `MACHINEN_PTY=${envOverride} is set but that file does not exist.`

514 );

515}

516function findBundledPtyShim() {

517 const pkg = `@machinen/native-${arch()}-${platform()}`;

518 try {

Lines 980-1020javascript

980 sock.on("error", fail);

981 sock.on("data", (chunk) => tar.stdin.write(chunk));

982 sock.on("end", () => tar.stdin.end());

983 sock.on("close", () => tar.stdin.end());

984 tar.on("exit"

Lines 6620-6660javascript

6620 describePortHolder(opts.hostPort).catch(() => null).then((holder) => {

6621 const hint = holder ? ` (${holder})` : " (set by another process \u2014 try `lsof -nP -iTCP:" + opts.hostPort + "`)";

6622

Source & flagged code

4 flagged · loading source

dist/index.jsView file

490// src/pty.ts L491: import { spawn } from "child_process"; L492: import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L490

1000* Run `cmd` inside the guest via the exec-agent. The command string L1001: * is passed verbatim to `sh -c` inside the guest, so shell syntax L1002: * (pipes, redirection, env) works.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L1000

6640req.once("error", fail); L6641: req.write(body); L6642: req.end(); ... L6649: warnedMissing = true; L6650: process.stderr.write( L6651: "machinen: gvproxy not found \u2014 microVM networking is disabled.\n Install: https://github.com/containers/gvisor-tap-vsock/releases\n Or point MACHINEN_GVPROXY at the binary d... L6652: ); ... L6655: // src/nested-virt.ts L6656: import { spawnSync as spawnSync2 } from "child_process"; L6657:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L6640

498var PTY_NAME = "machinen-pty"; L499: var require_ = createRequire(import.meta.url); L500: function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L498

Findings

3 High3 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 470-518javascript

470 return;

471 }

472 for (const r of rows) {

473 this.print(` ${r.id}

474`);

475 }

476 }

477 bannerText() {

478 return `machinen supervisor \u2014 commands start with '${this.prefix}'

479 /ls list sandboxes

480 /attach <id> forward terminal to/from a sandbox (Ctrl-] Ctrl-] to detach)

481 /quit stop the supervisor

482 /help show this message

483`;

484 }

485 print(msg) {

486 this.output.write(msg);

487 }

488};

489

490// src/pty.ts

491import { spawn } from "child_process";

492import { PassThrough } from "stream";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L490

493

494// src/native/pty.ts

495import { existsSync } from "fs";

496import { createRequire } from "module";

497import { arch, platform } from "os";

498var PTY_NAME = "machinen-pty";

499var require_ = createRequire(import.meta.url);

500function resolvePtyShim() {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L498

501 return resolvePtyShimEnvOverride() ?? findBundledPtyShim() ?? missingPtyShim();

502}

503function resolvePtyShimEnvOverride() {

504 const envOverride = process.env.MACHINEN_PTY;

505 if (!envOverride) {

506 return void 0;

507 }

508 if (existsSync(envOverride)) {

509 return envOverride;

510 }

511 throw new BootError(

512 "BOOT_VMM_PACKAGE_BROKEN",

513 `MACHINEN_PTY=${envOverride} is set but that file does not exist.`

514 );

515}

516function findBundledPtyShim() {

517 const pkg = `@machinen/native-${arch()}-${platform()}`;

518 try {

Lines 980-1020javascript

980 sock.on("error", fail);

981 sock.on("data", (chunk) => tar.stdin.write(chunk));

982 sock.on("end", () => tar.stdin.end());

983 sock.on("close", () => tar.stdin.end());

984 tar.on("exit"

Lines 6620-6660javascript

6620 describePortHolder(opts.hostPort).catch(() => null).then((holder) => {

6621 const hint = holder ? ` (${holder})` : " (set by another process \u2014 try `lsof -nP -iTCP:" + opts.hostPort + "`)";

6622