registry  /  @octostaff/reef  /  0.4.1

@octostaff/reef@0.4.1

OctoStaff reef connector worker — bridges Bubble and hosted A2A agents.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 548 KB of source, external domains: json-schema.org

Source & flagged code

4 flagged · loading source
dist/lib.jsView file
138`)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(` L139: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L140: ${r.newText}`);return e.length>0?e.join(`
High
Child Process

Package source references child process execution.

dist/lib.jsView on unpkg · L138
138`)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(` L139: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L140: ${r.newText}`);return e.length>0?e.join(` L141: `):void 0}function Jd(t){if(typeof t=="string")return t;if(t&&typeof t=="object"){let e=t;if(typeof e.error=="string")return e.error;if(typeof e.message=="string")return e.message}... L142: Error message: ${Wu(e)}`,cause:e}),this[Eu]=!0,this.text=t}static isInstance(t){return O.hasMarker(t,rc)}},nc="AI_LoadAPIKeyError",sc=`vercel.ai.error.${nc}`,yy=Symbol.for(sc),_u,C...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib.jsView on unpkg · L138
134`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===` L135: `?yield*this.pushCount(2):0}*pushSpaces(e){let r=this.pos-1,n;do n=this.buffer[++r];while(n===" "||e&&n===" ");let s=r-this.pos;return s>0&&(yield this.buffer.substr(this.pos,s),th... L136: `)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(` ... L138: `)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(` L139: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L140: ${r.newText}`);return e.length>0?e.join(` L141: `):void 0}function Jd(t){if(typeof t=="string")return t;if(t&&typeof t=="object"){let e=t;if(typeof e.error=="string")return e.error;if(typeof e.message=="string")return e.message}... L142: Error message: ${Wu(e)}`,cause:e}),this[Eu]=!0,this.text=t}static isInstance(t){return O.hasMarker(t,rc)}},nc="AI_LoadAPIKeyError",sc=`vercel.ai.error.${nc}`,yy=Symbol.for(sc),_u,C...
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/lib.jsView on unpkg · L134
package.jsonView file
scripts registry_only=build,dev,dev:azure,dev:mock,format,format:check,lint,lint:fix; devDependencies registry_only=@octostaff/bubble,@octostaff/devkit,@octostaff/sdk,@types/node,@types/ws,eslint,fastify,husky
Critical
Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

1 Critical3 High3 Medium5 Low
CriticalManifest Confusionpackage.json
HighChild Processdist/lib.js
HighSame File Env Network Executiondist/lib.js
HighCommand Output Exfiltrationdist/lib.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings