registry / @origintrail-official/dkg / 10.0.5

@origintrail-official/dkg@10.0.5

Command-line interface and daemon for DKG V10. This is the main entry point for running a DKG node — it manages the node lifecycle, exposes a local HTTP API, and provides commands for publishing, querying, and interacting with the network.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 151 file(s), 2.30 MB of source, external domains: 127.0.0.1, api.github.com, api.openai.com, basescan.org, discord.com, dkg.io, etherscan.io, example.com, github.com, java.sun.com, ontology.dkg.io, raw.githubusercontent.com, registry.npmjs.org, schema.org, sepolia.basescan.org, sepolia.etherscan.io, telemetry-testnet.origintrail.io, telemetry.origintrail.io, www.npmjs.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

Lines 53-81json

53 "build-info.json",

54 "scripts",

55 "skills",

56 "README.md",

57 "LICENSE"

58 ],

59 "license": "Apache-2.0",

60 "repository": {

61 "type": "git",

62 "url": "https://github.com/OriginTrail/dkg.git",

63 "directory": "packages/cli"

64 },

65 "scripts": {

66 "prebuild": "pnpm --filter @origintrail-official/dkg-adapter-openclaw run build && pnpm --filter @origintrail-official/dkg-adapter-hermes run build && pnpm --filter @origintrail-official/dkg-mcp run build && pnpm --filter @origintrail-official/dkg-okf run build",

67 "build": "tsc && node ../../scripts/copy-cli-runtime-assets.mjs",

68 "benchmark:catchup-runner": "node scripts/catchup-runner-benchmark.cjs",

69 "benchmark:daemon-responsiveness": "node scripts/daemon-responsiveness-benchmark.cjs",

70 "benchmark:publish-async-get": "node scripts/publish-async-get-benchmark.cjs",

71 "benchmark:swm-large-payload": "node scripts/swm-large-payload-benchmark.cjs",

72 "benchmark:swm-triple-volume": "node scripts/swm-triple-volume-benchmark.cjs",

73 "postinstall": "node ./scripts/bundle-markitdown-binaries.mjs --quiet --current-platform --best-effort",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "markitdown:build": "node ./scripts/bundle-markitdown-binaries.mjs --build-current-platform",

75 "test": "vitest run",

76 "test:unit": "vitest run --config vitest.unit.config.ts",

77 "test:benchmark:publish-async-get": "vitest run --config vitest.benchmark.config.ts",

78 "test:coverage": "vitest run --coverage",

79 "clean": "node -e \"const fs=require('fs');for(const d of['dist','network']){fs.rmSync(d,{recursive:true,force:true})};fs.rmSync('tsconfig.tsbuildinfo',{force:true})\""

80 }

81}

dist/cli-supervisor.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli-supervisor.jsView on unpkg · L1

3import { appendFile } from 'node:fs/promises';

4import { readApiPort, loadConfig, apiPortPath, removeApiPort, logPath, ensureDkgDir, } from './config.js';

dist/commands/hermes.jsView file

Lines 1-24javascript

1import { applyStoreFlagsToConfig } from '../store-wizard.js';

2export function registerHermesCommand(program) {

3 // ─── dkg ccl ────────────────────────────────────────────────────────

4 async function importHermesAdapterModule() {

5 const dynamicImport = new

dist/source-worker-runner.jsView file

Lines 36-76javascript

36 setInterval(() => {

37 void (async () => {

38 if (running) {

39 console.warn('[source-worker] skipping interval tick because previous run is still in progress');

40 return;

41 }

42 running

dist/daemon/manifest.jsView file

Lines 1-30javascript

1// Manifest / semver / skill-template / bundled-MarkItDown helpers

2// extracted from the legacy monolithic `daemon.ts`. Scope: helpers used

3// by the Phase-8 `/api/context-graph/{id}/manifest/*` routes, the

4// `/.well-known/skill.md` endpoint, and the auto-update binary

5// carry-forward flow. Pure functions with small caches; no HTTP

6// routing logic lives here.

7import { dirname, resolve, join } from 'node:path';

8import { createHash } from 'node:crypto';

scripts/swm-triple-volume-benchmark.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const { createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } = require('node:fs');

4const { dirname, isAbsolute, join, resolve }

scripts/markitdown-entry.pyView file

•path = scripts/markitdown-entry.py kind = build_helper sizeBytes = 873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/markitdown-entry.pyView on unpkg

dist/daemon/auto-update.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @origintrail-official/dkg@10.0.2 matchedIdentity = npm:[redacted]:10.0.2 similarity = 0.717 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon/auto-update.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/bundle-markitdown-binaries.mjs --quiet --current-platform --best-effort

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/bundle-markitdown-binaries.mjs --quiet --current-platform --best-effort

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli-supervisor.jsView file

1import { spawn } from 'node:child_process'; L2: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli-supervisor.jsView on unpkg · L1

85}); L86: const child = spawn(process.execPath, [...process.execArgv, resolveDaemonEntryPoint(), 'daemon-worker'], { L87: stdio: ['ignore', 'ignore', 'ignore'],

High

Shell

Package source references shell execution.

dist/cli-supervisor.jsView on unpkg · L85

dist/commands/hermes.jsView file

4async function importHermesAdapterModule() { L5: const dynamicImport = new Function('specifier', 'return import(specifier)'); L6: return dynamicImport('@origintrail-official/dkg-adapter-hermes');

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/hermes.jsView on unpkg · L4

dist/source-worker-runner.jsView file

56// handlerModule is trusted operator code selected by the sensitive worker config. L57: const namespace = await import(pathToFileURL(config.handlerModule).href); L58: const candidate = config.handlerExport

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/source-worker-runner.jsView on unpkg · L56

dist/daemon/manifest.jsView file

10import { chmod, copyFile, mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile, } from 'node:fs/promises'; L11: import { execSync, exec, execFile } from 'node:child_process'; L12: import { promisify } from 'node:util'; ... L69: try { L70: const pkgJsonPath = daemonRequire.resolve('@origintrail-official/dkg-mcp/package.json'); L71: const packageDir = dirname(pkgJsonPath); ... L115: const raw = readFileSync(pkgJsonPath, 'utf8'); L116: const parsed = JSON.parse(raw); L117: if (typeof parsed.version === 'string' && parsed.version.length > 0) ... L249: /** L250: * Format a `host:port` pair safely for an `http://` URL, including the L251: * IPv6-literal bracket rules from RFC-3986 §3.2.2 (`[::1]:9201`, not

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon/manifest.jsView on unpkg · L10

scripts/swm-triple-volume-benchmark.cjsView file

6const { createInterface } = require('node:readline'); L7: const { execFileSync } = require('node:child_process'); L8: ... L12: const DEFAULT_PREDICATE_BASE = 'urn:dkg:benchmark:swm-triple-volume:p'; L13: const DKG_ONTOLOGY = 'http://dkg.io/ontology/'; L14: const INVOCATION_CWD = process.env.INIT_CWD || process.cwd(); L15: const FAILURE_PATTERNS = [

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/swm-triple-volume-benchmark.cjsView on unpkg · L6

scripts/markitdown-entry.pyView file

•path = scripts/markitdown-entry.py kind = build_helper sizeBytes = 873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/markitdown-entry.pyView on unpkg

dist/daemon/auto-update.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon/auto-update.jsView on unpkg

Findings

5 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli-supervisor.js

HighShelldist/cli-supervisor.js

HighSame File Env Network Executionscripts/swm-triple-volume-benchmark.cjs

HighPrevious Version Dangerous Deltadist/daemon/auto-update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/source-worker-runner.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/markitdown-entry.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/commands/hermes.js

LowWeak Cryptodist/daemon/manifest.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

10 flagged

package.jsonView file

Lines 53-81json

53 "build-info.json",

54 "scripts",

55 "skills",

56 "README.md",

57 "LICENSE"

58 ],

59 "license": "Apache-2.0",

60 "repository": {

61 "type": "git",

62 "url": "https://github.com/OriginTrail/dkg.git",

63 "directory": "packages/cli"

64 },

65 "scripts": {

67 "build": "tsc && node ../../scripts/copy-cli-runtime-assets.mjs",

68 "benchmark:catchup-runner": "node scripts/catchup-runner-benchmark.cjs",

69 "benchmark:daemon-responsiveness": "node scripts/daemon-responsiveness-benchmark.cjs",

70 "benchmark:publish-async-get": "node scripts/publish-async-get-benchmark.cjs",

71 "benchmark:swm-large-payload": "node scripts/swm-large-payload-benchmark.cjs",

72 "benchmark:swm-triple-volume": "node scripts/swm-triple-volume-benchmark.cjs",

73 "postinstall": "node ./scripts/bundle-markitdown-binaries.mjs --quiet --current-platform --best-effort",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L73

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L73

74 "markitdown:build": "node ./scripts/bundle-markitdown-binaries.mjs --build-current-platform",

75 "test": "vitest run",

76 "test:unit": "vitest run --config vitest.unit.config.ts",

77 "test:benchmark:publish-async-get": "vitest run --config vitest.benchmark.config.ts",

78 "test:coverage": "vitest run --coverage",

79 "clean": "node -e \"const fs=require('fs');for(const d of['dist','network']){fs.rmSync(d,{recursive:true,force:true})};fs.rmSync('tsconfig.tsbuildinfo',{force:true})\""

80 }

81}

dist/cli-supervisor.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli-supervisor.jsView on unpkg · L1

3import { appendFile } from 'node:fs/promises';

4import { readApiPort, loadConfig, apiPortPath, removeApiPort, logPath, ensureDkgDir, } from './config.js';

dist/commands/hermes.jsView file

Lines 1-24javascript

1import { applyStoreFlagsToConfig } from '../store-wizard.js';

2export function registerHermesCommand(program) {

3 // ─── dkg ccl ────────────────────────────────────────────────────────

4 async function importHermesAdapterModule() {

5 const dynamicImport = new

dist/source-worker-runner.jsView file

Lines 36-76javascript

36 setInterval(() => {

37 void (async () => {

38 if (running) {

39 console.warn('[source-worker] skipping interval tick because previous run is still in progress');

40 return;

41 }

42 running

dist/daemon/manifest.jsView file

Lines 1-30javascript

1// Manifest / semver / skill-template / bundled-MarkItDown helpers

2// extracted from the legacy monolithic `daemon.ts`. Scope: helpers used

3// by the Phase-8 `/api/context-graph/{id}/manifest/*` routes, the

4// `/.well-known/skill.md` endpoint, and the auto-update binary

5// carry-forward flow. Pure functions with small caches; no HTTP

6// routing logic lives here.

7import { dirname, resolve, join } from 'node:path';

8import { createHash } from 'node:crypto';

scripts/swm-triple-volume-benchmark.cjsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const { createReadStream, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } = require('node:fs');

4const { dirname, isAbsolute, join, resolve }

scripts/markitdown-entry.pyView file

•path = scripts/markitdown-entry.py kind = build_helper sizeBytes = 873 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/markitdown-entry.pyView on unpkg

dist/daemon/auto-update.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon/auto-update.jsView on unpkg