registry / @posthog/agent / 2.3.1190

@posthog/agent@2.3.1190

⚠ Under review

TypeScript agent framework wrapping Claude Agent SDK with Git-based task execution for PostHog

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 166 file(s), 4.42 MB of source, external domains: a.com, app.dev.posthog.dev, app.posthog.com, b.com, eu.posthog.com, example.com, gateway.dev.posthog.dev, gateway.eu.posthog.com, gateway.timeout-test, gateway.us.posthog.com, github.com, logs.example.com, mcp.example.com, ngrok.test, posthog.com, posthog.slack.com, sandbox.example.com, sse.example.com, test.posthog.com, us.i.posthog.com, us.posthog.com

Source & flagged code

8 flagged

dist/handoff-checkpoint.jsView file

Lines 884-924javascript

884 },

885 get fulfilled() {

886 return status !== "pending";

887 },

888 get status() {

889 return status;

890 }

891 };

892 }

893 exports.deferred = deferred2;

894 exports.createDeferred = deferred2;

895 exports.default = deferred2;

896 }

897});

898

899// src/handoff-checkpoint.ts

900import { mkdtemp as mkdtemp2, readFile as readFile3, rm as rm3, writeFile as writeFile2 } from "fs/promises";

901import { tmpdir as tmpdir2 } from "os";

902import { dirname as dirname2, join as join3 } from "path";

903

904// ../git/dist/handoff.js

905import { spawn as spawn3 } from "child_process";

906import { copyFile, mkdtemp, readFile as readFile2, rm as rm2, stat as stat2 } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/handoff-checkpoint.jsView on unpkg · L904

907import { tmpdir } from "os";

908import path4 from "path";

909

910// ../../node_modules/simple-git/dist/esm/index.js

911var import_file_exists = __toESM(require_dist(), 1);

912var import_debug = __toESM(require_src(), 1);

913var import_promise_deferred = __toESM(require_dist2(), 1);

914var import_promise_deferred2 = __toESM(require_dist2(), 1);

915import { Buffer as Buffer2 } from "buffer";

916import { spawn } from "child_process";

917import { normalize } from "path";

918import { EventEmitter } from "events";

919var __defProp2 = Object.defineProperty;

920var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;

921var __getOwnPropNames2 = Object.getOwnPropertyNames;

922var __hasOwnProp2 = Object.prototype.hasOwnProperty;

923var __esm = (fn, res) => function __init() {

924 return fn && (res = (0, fn[__getOwnPropNames2(fn)[0]])(fn = 0)), res;

dist/server/agent-server.jsView file

19723} L19724: async function handlePostHogExecApprovalFlow(context, subTool) { L19725: const { toolName, toolInput, toolUseID, client, sessionId, session } = context;

High

Shell

Package source references shell execution.

dist/server/agent-server.jsView on unpkg · L19723

171for (let i2 = 0; i2 < namespace.length; i2++) { L172: hash = (hash << 5) - hash + namespace.charCodeAt(i2); L173: hash |= 0; ... L431: let m; L432: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L433: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L476: if (!r && typeof process !== "undefined" && "env" in process) { L477: r = process.env.DEBUG; L478: } ... L562: } L563: if (process.platform === "win32") { L564: const osRelease = os9.release().split(".");

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server/agent-server.jsView on unpkg · L171

171Cross-file remote execution chain: dist/server/agent-server.js spawns dist/handoff-checkpoint.js; helper contains network access plus dynamic code execution. L171: for (let i2 = 0; i2 < namespace.length; i2++) { L172: hash = (hash << 5) - hash + namespace.charCodeAt(i2); L173: hash |= 0; ... L431: let m; L432: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L433: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L476: if (!r && typeof process !== "undefined" && "env" in process) { L477: r = process.env.DEBUG; L478: } ... L562: } L563: if (process.platform === "win32") { L564: const osRelease = os9.release().split(".");

dist/claude-cli/claudeView file

•path = dist/claude-cli/claude kind = native_binary sizeBytes = 247469776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/claude-cli/claudeView on unpkg

src/adapters/codex/codex-agent.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @posthog/agent@2.3.1187 matchedIdentity = npm:QHBvc3Rob2cvYWdlbnQ:2.3.1187 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/adapters/codex/codex-agent.tsView on unpkg

src/server/agent-server.test.tsView file

Lines 305-345typescript

305 },

306 );

307}

308

309function sessionUpdateEntry(

310 sessionUpdate: string,

311 extra: Record<string, unknown> = {},

312

Source & flagged code

8 flagged · loading source

dist/handoff-checkpoint.jsView file

904// ../git/dist/handoff.js L905: import { spawn as spawn3 } from "child_process"; L906: import { copyFile, mkdtemp, readFile as readFile2, rm as rm2, stat as stat2 } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/handoff-checkpoint.jsView on unpkg · L904

dist/server/agent-server.jsView file

19723} L19724: async function handlePostHogExecApprovalFlow(context, subTool) { L19725: const { toolName, toolInput, toolUseID, client, sessionId, session } = context;

High

Shell

Package source references shell execution.

dist/server/agent-server.jsView on unpkg · L19723

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server/agent-server.jsView on unpkg · L171

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/agent-server.jsView on unpkg · L171

1820var func = `(${args}) => { ${body} };`; L1821: ASM_CONSTS[start] = eval(func); L1822: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server/agent-server.jsView on unpkg · L1820

dist/claude-cli/claudeView file

•path = dist/claude-cli/claude kind = native_binary sizeBytes = 247469776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/claude-cli/claudeView on unpkg

src/adapters/codex/codex-agent.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/adapters/codex/codex-agent.tsView on unpkg

src/server/agent-server.test.tsView file

325patternName = private_key_rsa severity = critical line = 325 matchedText = const TE...----

Critical

Secret Pattern

RSA private key in src/server/agent-server.test.ts

src/server/agent-server.test.tsView on unpkg · L325

Findings

2 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/adapters/codex/codex-agent.ts

CriticalSecret Patternsrc/server/agent-server.test.ts

HighChild Processdist/handoff-checkpoint.js

HighShelldist/server/agent-server.js

HighObfuscated Payload Loaderdist/server/agent-server.js

HighCross File Remote Execution Contextdist/server/agent-server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/claude-cli/claude

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/server/agent-server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/handoff-checkpoint.jsView file

Lines 884-924javascript

884 },

885 get fulfilled() {

886 return status !== "pending";

887 },

888 get status() {

889 return status;

890 }

891 };

892 }

893 exports.deferred = deferred2;

894 exports.createDeferred = deferred2;

895 exports.default = deferred2;

896 }

897});

898

899// src/handoff-checkpoint.ts

900import { mkdtemp as mkdtemp2, readFile as readFile3, rm as rm3, writeFile as writeFile2 } from "fs/promises";

901import { tmpdir as tmpdir2 } from "os";

902import { dirname as dirname2, join as join3 } from "path";

903

904// ../git/dist/handoff.js

905import { spawn as spawn3 } from "child_process";

906import { copyFile, mkdtemp, readFile as readFile2, rm as rm2, stat as stat2 } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/handoff-checkpoint.jsView on unpkg · L904

907import { tmpdir } from "os";

908import path4 from "path";

909

910// ../../node_modules/simple-git/dist/esm/index.js

911var import_file_exists = __toESM(require_dist(), 1);

912var import_debug = __toESM(require_src(), 1);

913var import_promise_deferred = __toESM(require_dist2(), 1);

914var import_promise_deferred2 = __toESM(require_dist2(), 1);

915import { Buffer as Buffer2 } from "buffer";

916import { spawn } from "child_process";

917import { normalize } from "path";

918import { EventEmitter } from "events";

919var __defProp2 = Object.defineProperty;

920var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;

921var __getOwnPropNames2 = Object.getOwnPropertyNames;

922var __hasOwnProp2 = Object.prototype.hasOwnProperty;

923var __esm = (fn, res) => function __init() {

924 return fn && (res = (0, fn[__getOwnPropNames2(fn)[0]])(fn = 0)), res;

dist/server/agent-server.jsView file

19723} L19724: async function handlePostHogExecApprovalFlow(context, subTool) { L19725: const { toolName, toolInput, toolUseID, client, sessionId, session } = context;

High

Shell

Package source references shell execution.

dist/server/agent-server.jsView on unpkg · L19723

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server/agent-server.jsView on unpkg · L171

dist/claude-cli/claudeView file

•path = dist/claude-cli/claude kind = native_binary sizeBytes = 247469776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/claude-cli/claudeView on unpkg

src/adapters/codex/codex-agent.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

src/adapters/codex/codex-agent.tsView on unpkg

src/server/agent-server.test.tsView file

Lines 305-345typescript

305 },

306 );

307}

308

309function sessionUpdateEntry(

310 sessionUpdate: string,

311 extra: Record<string, unknown> = {},

312