registry / @origintrail-official/dkg-agent / 10.0.5

@origintrail-official/dkg-agent@10.0.5

Agent runtime for DKG V10. Provides the `DKGAgent` class — the primary entry point for building agents that participate in the decentralized knowledge network.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 103 file(s), 2.24 MB of source, external domains: dkg.io, dkg.network, dkg.origintrail.io, eips.ethereum.org, example.org, schema.org, www.w3.org

Source & flagged code

3 flagged

dist/generic-sql-source.jsView file

Lines 404-444javascript

404 requestTimeoutMs: source.connection.requestTimeoutMs ?? null,

405 },

406 mappingId: mapping.id,

407 mappingVersion: mapping.version,

408 mappingDefinitionFingerprint: hashStable(mapping),

409 parameters: source.parameters ?? {},

410 };

411}

412async function createMssqlClient(connection, source) {

413 const server = readRequiredEnv(source.id, 'server', connection.serverEnv ?? connection.hostEnv);

414 const database = readRequiredEnv(source.id, 'database', connection.databaseEnv);

415 const user = readRequiredEnv(source.id, 'user', connection.userEnv);

416 const password = readRequiredEnv(source.id, 'password', connection.passwordEnv);

417 const portValue = readOptionalEnv(connection.portEnv);

418 const port = portValue ? Number(portValue) : undefined;

419 if (portValue && (!Number.isInteger(port) || port <= 0)) {

420 throw new Error(`Generic SQL source ${source.id} has invalid SQL Server port in ${connection.portEnv}`);

421 }

422 let module;

423 try {

424 const moduleName = 'mssql';

425 module = await import(moduleName);

426 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generic-sql-source.jsView on unpkg · L424

427 catch (error) {

428 throw new Error(`Generic SQL source ${source.id} requires optional package mssql for dialect mssql: ${error instanceof Error ? error.message : String(error)}`);

429 }

430 const pool = await new module.ConnectionPool({

431 server,

432 database,

433 user,

434 password,

435 port,

436 options: {

437 encrypt: connection.encrypt ?? true,

438 trustServerCertificate: connection.trustServerCertificate ?? false,

439 },

440 requestTimeout: connection.requestTimeoutMs ?? 30000,

441 }).connect();

442 return {

443 async query(sql, parameters) {

444 const request = pool.request();

dist/dkg-agent-context-graph.jsView file

Lines 118-158javascript

118 // See the boundary block above for rationale (Codex PR #610

119 // fd5b31f1 follow-up).

120 quads.push({ subject: contextGraphUri, predicate: DKG_ONTOLOGY.DKG_REGISTRATION_STATUS, object: `"unregistered"`, graph: cgMetaGraph }, { subject: contextGraphUri, predicate: DKG_ONTOLOGY.DKG_CURATOR, object: curatorDid, graph: cgMetaGraph });

121 if (opts.publishPolicy !== undefined) {

122 quads.push

dist/dkg-agent-endorse.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @origintrail-official/dkg-agent@10.0.2 matchedIdentity = npm:[redacted]:10.0.2 similarity = 0.753 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dkg-agent-endorse.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/generic-sql-source.jsView file

424const moduleName = 'mssql'; L425: module = await import(moduleName); L426: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generic-sql-source.jsView on unpkg · L424

dist/dkg-agent-context-graph.jsView file

138package = @origintrail-official/dkg-agent; repositoryIdentity = dkg; dependency = @libp2p/peer-id L138: if (opts.allowedPeers && opts.allowedPeers.length > 0) { L139: const { peerIdFromString } = await import('@libp2p/peer-id'); L140: for (const peer of opts.allowedPeers) {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/dkg-agent-context-graph.jsView on unpkg · L138

dist/dkg-agent-endorse.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dkg-agent-endorse.jsView on unpkg

Findings

2 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/dkg-agent-context-graph.js

HighPrevious Version Dangerous Deltadist/dkg-agent-endorse.js

MediumDynamic Requiredist/generic-sql-source.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/generic-sql-source.jsView file

Lines 404-444javascript

404 requestTimeoutMs: source.connection.requestTimeoutMs ?? null,

405 },

406 mappingId: mapping.id,

407 mappingVersion: mapping.version,

408 mappingDefinitionFingerprint: hashStable(mapping),

409 parameters: source.parameters ?? {},

410 };

411}

412async function createMssqlClient(connection, source) {

413 const server = readRequiredEnv(source.id, 'server', connection.serverEnv ?? connection.hostEnv);

414 const database = readRequiredEnv(source.id, 'database', connection.databaseEnv);

415 const user = readRequiredEnv(source.id, 'user', connection.userEnv);

416 const password = readRequiredEnv(source.id, 'password', connection.passwordEnv);

417 const portValue = readOptionalEnv(connection.portEnv);

418 const port = portValue ? Number(portValue) : undefined;

419 if (portValue && (!Number.isInteger(port) || port <= 0)) {

420 throw new Error(`Generic SQL source ${source.id} has invalid SQL Server port in ${connection.portEnv}`);

421 }

422 let module;

423 try {

424 const moduleName = 'mssql';

425 module = await import(moduleName);

426 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/generic-sql-source.jsView on unpkg · L424

427 catch (error) {

428 throw new Error(`Generic SQL source ${source.id} requires optional package mssql for dialect mssql: ${error instanceof Error ? error.message : String(error)}`);

429 }

430 const pool = await new module.ConnectionPool({

431 server,

432 database,

433 user,

434 password,

435 port,

436 options: {

437 encrypt: connection.encrypt ?? true,

438 trustServerCertificate: connection.trustServerCertificate ?? false,

439 },

440 requestTimeout: connection.requestTimeoutMs ?? 30000,

441 }).connect();

442 return {

443 async query(sql, parameters) {

444 const request = pool.request();

dist/dkg-agent-context-graph.jsView file

Lines 118-158javascript

118 // See the boundary block above for rationale (Codex PR #610

119 // fd5b31f1 follow-up).

121 if (opts.publishPolicy !== undefined) {

122 quads.push

dist/dkg-agent-endorse.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/dkg-agent-endorse.jsView on unpkg