registry / @nerdyy/agentix / 2.1.6

@nerdyy/agentix@2.1.6

Agentix CLI - AI coding agent with Agentix shell and orchestration backend

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 699 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.github.com, api.groq.com, api.kilo.ai, api.mistral.ai, api.openai.com, api.telegram.org, api.x.ai, discord.com, github.com, graph.microsoft.com, ollama.com, openrouter.ai, registry.npmjs.org, slack.com, slsa.dev

Source & flagged code

12 flagged

hermes-agent/agent/redact.pyView file

Lines 114-154python

114

115# JSON field patterns: "apiKey": "value", "token": "value", etc.

117_JSON_FIELD_RE = re.compile(

118 rf'("{_JSON_KEY_NAMES}")\s*:\s*"([^"]+)"',

119 re.IGNORECASE,

120)

121

122# Authorization headers

123_AUTH_HEADER_RE = re.compile(

124 r"(Authorization:\s*Bearer\s+)(\S+)",

125 re.IGNORECASE,

126)

127

128# Telegram bot tokens: bot<digits>:<token> or <digits>:<token>,

129# where token part is restricted to [-A-Za-z0-9_] and length >= 30

130_TELEGRAM_RE = re.compile(

131 r"(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})",

132)

133

134# Private key blocks: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hermes-agent/agent/redact.pyView on unpkg · L134

135_PRIVATE_KEY_RE = re.compile(

136 r"-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----"

137)

138

139# Database connection strings: protocol://user:PASSWORD@host

140# Catches postgres, mysql, mongodb, redis, amqp URLs and redacts the password

141_DB_CONNSTR_RE = re.compile(

142 r"((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:]+:)([^@]+)(@)",

143 re.IGNORECASE,

144)

145

146# JWT tokens: header.payload[.signature] — always start with "eyJ" (base64 for "{")

147# Matches 1-part (header only), 2-part (header.payload), and full 3-part JWTs.

148_JWT_RE = re.compile(

149 r"eyJ[A-Za-z0-9_-]{10,}" # Header (always starts with eyJ)

150 r"(?:\.[A-Za-z0-9_=-]{4,}){0,2}" # Optional payload and/or signature

151)

152

153# E.164 phone numbers: +<country><number>, 7-15 digits

154# Negative lookahead prevents matching hex strings or identifiers

134patternName = private_key_rsa severity = critical line = 134 matchedText = # Privat...----

Critical

Secret Pattern

RSA private key in hermes-agent/agent/redact.py

hermes-agent/agent/redact.pyView on unpkg · L134

bin/agentix.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

4import { spawn, spawnSync } from "child_process";

5import { createRequire } from "module";

High

Child Process

Package source references child process execution.

bin/agentix.jsView on unpkg · L3

6import { fileURLToPath } from

dist/pi/BashAgent.jsView file

Lines 60-91javascript

60 : { ok: false, error: `exit ${code}`, output: { stdout, stderr, exitCode: code, duration } };

61 if (result.ok)

62 this.emitComplete(task, result);

63 else

64 this.emitError(task, result.error ?? "bash failed");

scripts/release-smoke.mjsView file

Lines 577-617javascript

577 });

578

579 const preserved = JSON.parse(readFileSync(join(workspaceData, "config.json"), "utf-8"));

580 assert(preserved.model === "preserved-upgrade-model", "global reinstall mutated workspace model config");

581

scripts/verify-public-release.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";

4import { readFileSync } from "node:fs";

5import { dirname, join, resolve } from "node:path";

dist/pi/CodeAgent.jsView file

Lines 53-93javascript

53 if (!validation.ok) {

54 this.emitError(task, validation.error ?? "tsc failed");

55 return validation;

56 }

57 return { ok: true, output: { file: filePath, validated: true } };

58 }

install.shView file

•path = install.sh kind = build_helper sizeBytes = 4730 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdfView file

•path = hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdf kind = high_entropy_blob sizeBytes = 122635 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdfView on unpkg

hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.pyView file

•path = hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.py kind = payload_in_excluded_dir sizeBytes = 6798 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.pyView on unpkg

hermes-agent/tools/terminal_tool.pyView file

Lines 773-813python

773 Callers that drive a subprocess directly (local, ssh, docker, singularity)

774 should prepend sudo_stdin to their stdin_data and pass the merged bytes to

775 Popen's stdin pipe.

776

777 Callers that cannot pipe subprocess stdin (modal, daytona) must embed

778 the password in the command string themselves; see their execute()

779 methods for how they handle the non-None sudo_stdin case.

780

781 If SUDO_PASSWORD is not set and in interactive mode (HERMES_INTERACTIVE=1):

782 Prompts user for password with 45s timeout, caches for session.

783

Source & flagged code

12 flagged · loading source

hermes-agent/agent/redact.pyView file

134patternName = private_key_rsa severity = critical line = 134 matchedText = # Privat...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hermes-agent/agent/redact.pyView on unpkg · L134

134patternName = private_key_rsa severity = critical line = 134 matchedText = # Privat...----

Critical

Secret Pattern

RSA private key in hermes-agent/agent/redact.py

hermes-agent/agent/redact.pyView on unpkg · L134

bin/agentix.jsView file

3import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; L4: import { spawn, spawnSync } from "child_process"; L5: import { createRequire } from "module";

High

Child Process

Package source references child process execution.

bin/agentix.jsView on unpkg · L3

3Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L3: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; L4: import { spawn, spawnSync } from "child_process"; L5: import { createRequire } from "module"; ... L8: import os from "os"; L9: import http from "http"; L10: import net from "net"; ... L12: const __filename = fileURLToPath(import.meta.url); L13: const __dirname = dirname(__filename); L14: const PROJECT_ROOT = resolve(__dirname, ".."); ... L16: const require = createRequire(import.meta.url); L17: const pkg = require("../package.json"); L18:

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/agentix.jsView on unpkg · L3

dist/pi/BashAgent.jsView file

80return { L81: command: process.env.ComSpec ?? "cmd.exe", L82: args: ["/d", "/s", "/c", payload.commandLine],

High

Shell

Package source references shell execution.

dist/pi/BashAgent.jsView on unpkg · L80

scripts/release-smoke.mjsView file

597const bridgePort = await freePort(); L598: const bridgeUrl = `http://127.0.0.1:${bridgePort}`; L599: const inboxUrl = `http://127.0.0.1:${inboxPort}`; L600: const serverEnv = { L601: ...process.env, L602: AGENTIX_SESSION_TOKEN: "", ... L610: log(`starting installed server on inbox ${inboxPort}, bridge ${bridgePort}`); L611: const server = spawn(process.execPath, [ L612: agentixEntrypoint,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/release-smoke.mjsView on unpkg · L597

scripts/verify-public-release.mjsView file

1import { spawn } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L10: const root = resolve(dirname(__filename), ".."); L11: const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8")); L12: ... L34: async function fetchJson(url) { L35: const response = await fetch(url, { signal: AbortSignal.timeout(30_000) }); L36: const text = await response.text(); ... L60: cwd: opts.cwd ?? root, L61: env: opts.env ?? process.env, L62: shell: process.platform === "win32" && /\.cmd$/i.test(command), L63: windowsHide: true,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/verify-public-release.mjsView on unpkg · L1

dist/pi/CodeAgent.jsView file

73return new Promise((resolve) => { L74: const child = spawn("npx", ["tsc", "--noEmit"], { L75: cwd: this.projectRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/pi/CodeAgent.jsView on unpkg · L73

install.shView file

•path = install.sh kind = build_helper sizeBytes = 4730 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdfView file

•path = hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdf kind = high_entropy_blob sizeBytes = 122635 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdfView on unpkg

hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.pyView file

•path = hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.py kind = payload_in_excluded_dir sizeBytes = 6798 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.pyView on unpkg

hermes-agent/tools/terminal_tool.pyView file

793patternName = generic_password severity = medium line = 793 matchedText = has_conf...iron

Medium

Secret Pattern

Hardcoded password in hermes-agent/tools/terminal_tool.py

hermes-agent/tools/terminal_tool.pyView on unpkg · L793

Findings

2 Critical8 High5 Medium4 Low

CriticalCritical Secrethermes-agent/agent/redact.py

CriticalSecret Patternhermes-agent/agent/redact.py

HighChild Processbin/agentix.js

HighShelldist/pi/BashAgent.js

HighEntrypoint Build Divergencebin/agentix.js

HighSame File Env Network Executionscripts/release-smoke.mjs

HighSandbox Evasion Gated Capabilityscripts/verify-public-release.mjs

HighRuntime Package Installdist/pi/CodeAgent.js

HighShips High Entropy Blobhermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdf

HighPayload In Excluded Dirhermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.py

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternhermes-agent/tools/terminal_tool.py

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

hermes-agent/agent/redact.pyView file

Lines 114-154python

114

115# JSON field patterns: "apiKey": "value", "token": "value", etc.

117_JSON_FIELD_RE = re.compile(

118 rf'("{_JSON_KEY_NAMES}")\s*:\s*"([^"]+)"',

119 re.IGNORECASE,

120)

121

122# Authorization headers

123_AUTH_HEADER_RE = re.compile(

124 r"(Authorization:\s*Bearer\s+)(\S+)",

125 re.IGNORECASE,

126)

127

128# Telegram bot tokens: bot<digits>:<token> or <digits>:<token>,

129# where token part is restricted to [-A-Za-z0-9_] and length >= 30

130_TELEGRAM_RE = re.compile(

131 r"(bot)?(\d{8,}):([-A-Za-z0-9_]{30,})",

132)

133

134# Private key blocks: -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hermes-agent/agent/redact.pyView on unpkg · L134

135_PRIVATE_KEY_RE = re.compile(

136 r"-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----"

137)

138

139# Database connection strings: protocol://user:PASSWORD@host

140# Catches postgres, mysql, mongodb, redis, amqp URLs and redacts the password

141_DB_CONNSTR_RE = re.compile(

142 r"((?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp)://[^:]+:)([^@]+)(@)",

143 re.IGNORECASE,

144)

145

146# JWT tokens: header.payload[.signature] — always start with "eyJ" (base64 for "{")

147# Matches 1-part (header only), 2-part (header.payload), and full 3-part JWTs.

148_JWT_RE = re.compile(

149 r"eyJ[A-Za-z0-9_-]{10,}" # Header (always starts with eyJ)

150 r"(?:\.[A-Za-z0-9_=-]{4,}){0,2}" # Optional payload and/or signature

151)

152

153# E.164 phone numbers: +<country><number>, 7-15 digits

154# Negative lookahead prevents matching hex strings or identifiers

134patternName = private_key_rsa severity = critical line = 134 matchedText = # Privat...----

Critical

Secret Pattern

RSA private key in hermes-agent/agent/redact.py

hermes-agent/agent/redact.pyView on unpkg · L134

bin/agentix.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

4import { spawn, spawnSync } from "child_process";

5import { createRequire } from "module";

High

Child Process

Package source references child process execution.

bin/agentix.jsView on unpkg · L3

6import { fileURLToPath } from

dist/pi/BashAgent.jsView file

Lines 60-91javascript

60 : { ok: false, error: `exit ${code}`, output: { stdout, stderr, exitCode: code, duration } };

61 if (result.ok)

62 this.emitComplete(task, result);

63 else

64 this.emitError(task, result.error ?? "bash failed");

scripts/release-smoke.mjsView file

Lines 577-617javascript

577 });

578

579 const preserved = JSON.parse(readFileSync(join(workspaceData, "config.json"), "utf-8"));

580 assert(preserved.model === "preserved-upgrade-model", "global reinstall mutated workspace model config");

581

scripts/verify-public-release.mjsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createHash } from "node:crypto";

3import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";

4import { readFileSync } from "node:fs";

5import { dirname, join, resolve } from "node:path";

dist/pi/CodeAgent.jsView file

Lines 53-93javascript

53 if (!validation.ok) {

54 this.emitError(task, validation.error ?? "tsc failed");

55 return validation;

56 }

57 return { ok: true, output: { file: filePath, validated: true } };

58 }

install.shView file

•path = install.sh kind = build_helper sizeBytes = 4730 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdfView file

•path = hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdf kind = high_entropy_blob sizeBytes = 122635 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

hermes-agent/skills/research/research-paper-writing/templates/colm2025/colm2025_conference.pdfView on unpkg

hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.pyView file

•path = hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.py kind = payload_in_excluded_dir sizeBytes = 6798 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

hermes-agent/plugins/hermes-achievements/tests/test_achievement_engine.pyView on unpkg

hermes-agent/tools/terminal_tool.pyView file

Lines 773-813python

773 Callers that drive a subprocess directly (local, ssh, docker, singularity)

774 should prepend sudo_stdin to their stdin_data and pass the merged bytes to

775 Popen's stdin pipe.

776

777 Callers that cannot pipe subprocess stdin (modal, daytona) must embed

778 the password in the command string themselves; see their execute()

779 methods for how they handle the non-None sudo_stdin case.

780

781 If SUDO_PASSWORD is not set and in interactive mode (HERMES_INTERACTIVE=1):

782 Prompts user for password with 45s timeout, caches for session.

783