registry / @origintrail-official/dkg-agent / 10.0.2

@origintrail-official/dkg-agent@10.0.2

Agent runtime for DKG V10. Provides the `DKGAgent` class — the primary entry point for building agents that participate in the decentralized knowledge network.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 89 file(s), 2.09 MB of source, external domains: dkg.io, dkg.network, dkg.origintrail.io, eips.ethereum.org, example.org, schema.org, www.w3.org

Source & flagged code

2 flagged

dist/generic-sql-source.jsView file

Lines 404-444javascript

404 requestTimeoutMs: source.connection.requestTimeoutMs ?? null,

405 },

406 mappingId: mapping.id,

407 mappingVersion: mapping.version,

408 mappingDefinitionFingerprint: hashStable(mapping),

409 parameters: source.parameters ?? {},

410 };

411}

412async function createMssqlClient(connection, source) {

413 const server = readRequiredEnv(source.id, 'server', connection.serverEnv ?? connection.hostEnv);

414 const database = readRequiredEnv(source.id, 'database', connection.databaseEnv);

415 const user = readRequiredEnv(source.id, 'user', connection.userEnv);

416 const password = readRequiredEnv(source.id, 'password', connection.passwordEnv);

417 const portValue = readOptionalEnv(connection.portEnv);

418 const port = portValue ? Number(portValue) : undefined;

419 if (portValue && (!Number.isInteger(port) || port <= 0)) {

420 throw new Error(`Generic SQL source ${source.id} has invalid SQL Server port in ${connection.portEnv}`);

421 }

422 let module;

423 try {

424 const moduleName = 'mssql';

425 module = await import(moduleName);

426 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generic-sql-source.jsView on unpkg · L424

427 catch (error) {

428 throw new Error(`Generic SQL source ${source.id} requires optional package mssql for dialect mssql: ${error instanceof Error ? error.message : String(error)}`);

429 }

430 const pool = await new module.ConnectionPool({

431 server,

432 database,

433 user,

434 password,

435 port,

436 options: {

437 encrypt: connection.encrypt ?? true,

438 trustServerCertificate: connection.trustServerCertificate ?? false,

439 },

440 requestTimeout: connection.requestTimeoutMs ?? 30000,

441 }).connect();

442 return {

443 async query(sql, parameters) {

444 const request = pool.request();

dist/dkg-agent-context-graph.jsView file

Lines 107-147javascript

107 // See the boundary block above for rationale (Codex PR #610

108 // fd5b31f1 follow-up).

109 quads.push({ subject: contextGraphUri, predicate: DKG_ONTOLOGY.DKG_REGISTRATION_STATUS, object: `"unregistered"`, graph: cgMetaGraph }, { subject: contextGraphUri, predicate: DKG_ONTOLOGY.DKG_CURATOR, object: curatorDid, graph: cgMetaGraph });

110 if (opts.publishPolicy !== undefined) {

111 quads.push

Source & flagged code

2 flagged · loading source

dist/generic-sql-source.jsView file

424const moduleName = 'mssql'; L425: module = await import(moduleName); L426: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generic-sql-source.jsView on unpkg · L424

dist/dkg-agent-context-graph.jsView file

127package = @origintrail-official/dkg-agent; repositoryIdentity = dkg; dependency = @libp2p/peer-id L127: if (opts.allowedPeers && opts.allowedPeers.length > 0) { L128: const { peerIdFromString } = await import('@libp2p/peer-id'); L129: for (const peer of opts.allowedPeers) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/dkg-agent-context-graph.jsView on unpkg · L127

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/dkg-agent-context-graph.js

MediumDynamic Requiredist/generic-sql-source.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/generic-sql-source.jsView file

Lines 404-444javascript

404 requestTimeoutMs: source.connection.requestTimeoutMs ?? null,

405 },

406 mappingId: mapping.id,

407 mappingVersion: mapping.version,

408 mappingDefinitionFingerprint: hashStable(mapping),

409 parameters: source.parameters ?? {},

410 };

411}

412async function createMssqlClient(connection, source) {

413 const server = readRequiredEnv(source.id, 'server', connection.serverEnv ?? connection.hostEnv);

414 const database = readRequiredEnv(source.id, 'database', connection.databaseEnv);

415 const user = readRequiredEnv(source.id, 'user', connection.userEnv);

416 const password = readRequiredEnv(source.id, 'password', connection.passwordEnv);

417 const portValue = readOptionalEnv(connection.portEnv);

418 const port = portValue ? Number(portValue) : undefined;

419 if (portValue && (!Number.isInteger(port) || port <= 0)) {

420 throw new Error(`Generic SQL source ${source.id} has invalid SQL Server port in ${connection.portEnv}`);

421 }

422 let module;

423 try {

424 const moduleName = 'mssql';

425 module = await import(moduleName);

426 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generic-sql-source.jsView on unpkg · L424

427 catch (error) {

428 throw new Error(`Generic SQL source ${source.id} requires optional package mssql for dialect mssql: ${error instanceof Error ? error.message : String(error)}`);

429 }

430 const pool = await new module.ConnectionPool({

431 server,

432 database,

433 user,

434 password,

435 port,

436 options: {

437 encrypt: connection.encrypt ?? true,

438 trustServerCertificate: connection.trustServerCertificate ?? false,

439 },

440 requestTimeout: connection.requestTimeoutMs ?? 30000,

441 }).connect();

442 return {

443 async query(sql, parameters) {

444 const request = pool.request();

dist/dkg-agent-context-graph.jsView file

Lines 107-147javascript

107 // See the boundary block above for rationale (Codex PR #610

108 // fd5b31f1 follow-up).

110 if (opts.publishPolicy !== undefined) {

111 quads.push