registry / @posthog/agent / 2.3.1393

@posthog/agent@2.3.1393

TypeScript agent framework wrapping Claude Agent SDK with Git-based task execution for PostHog

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 198 file(s), 5.15 MB of source, external domains: a.com, app.dev.posthog.dev, app.posthog.com, b.com, eu.posthog.com, example.com, gateway.dev.posthog.dev, gateway.eu.posthog.com, gateway.example, gateway.timeout-test, gateway.us.posthog.com, github.com, logs.example.com, mcp.example, mcp.example.com, ngrok.test, posthog.com, posthog.slack.com, sandbox.example.com, sse.example.com, test.posthog.com, us.i.posthog.com, us.posthog.com

Source & flagged code

7 flagged

dist/handoff-checkpoint.jsView file

Lines 885-925javascript

885 },

886 get fulfilled() {

887 return status !== "pending";

888 },

889 get status() {

890 return status;

891 }

892 };

893 }

894 exports.deferred = deferred2;

895 exports.createDeferred = deferred2;

896 exports.default = deferred2;

897 }

898});

899

900// src/handoff-checkpoint.ts

901import { mkdtemp as mkdtemp2, readFile as readFile3, rm as rm3, writeFile as writeFile2 } from "fs/promises";

902import { tmpdir as tmpdir2 } from "os";

903import { dirname as dirname2, join as join3 } from "path";

904

905// ../git/dist/handoff.js

906import { spawn as spawn3 } from "child_process";

907import { copyFile, mkdtemp, readFile as readFile2, rm as rm2, stat as stat2 } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/handoff-checkpoint.jsView on unpkg · L905

908import { tmpdir } from "os";

909import path4 from "path";

910

911// ../../node_modules/simple-git/dist/esm/index.js

912var import_file_exists = __toESM(require_dist(), 1);

913var import_debug = __toESM(require_src(), 1);

914var import_promise_deferred = __toESM(require_dist2(), 1);

915var import_promise_deferred2 = __toESM(require_dist2(), 1);

916import { Buffer as Buffer2 } from "buffer";

917import { spawn } from "child_process";

918import { normalize } from "path";

919import { EventEmitter } from "events";

920var __defProp2 = Object.defineProperty;

921var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;

922var __getOwnPropNames2 = Object.getOwnPropertyNames;

923var __hasOwnProp2 = Object.prototype.hasOwnProperty;

924var __esm = (fn, res) => function __init() {

925 return fn && (res = (0, fn[__getOwnPropNames2(fn)[0]])(fn = 0)), res;

dist/server/agent-server.jsView file

20224} L20225: async function handlePostHogExecApprovalFlow(context, subTool) { L20226: const { toolName, toolInput, toolUseID, sessionId, session } = context;

High

Shell

Package source references shell execution.

dist/server/agent-server.jsView on unpkg · L20224

172for (let i2 = 0; i2 < namespace.length; i2++) { L173: hash = (hash << 5) - hash + namespace.charCodeAt(i2); L174: hash |= 0; ... L432: let m; L433: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L434: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L477: if (!r && typeof process !== "undefined" && "env" in process) { L478: r = process.env.DEBUG; L479: } ... L563: } L564: if (process.platform === "win32") { L565: const osRelease = os10.release().split(".");

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server/agent-server.jsView on unpkg · L172

172Cross-file remote execution chain: dist/server/agent-server.js spawns dist/handoff-checkpoint.js; helper contains network access plus dynamic code execution. L172: for (let i2 = 0; i2 < namespace.length; i2++) { L173: hash = (hash << 5) - hash + namespace.charCodeAt(i2); L174: hash |= 0; ... L432: let m; L433: return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || // Is firebug? http://sta... L434: typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || // Is firefox >= v31? ... L477: if (!r && typeof process !== "undefined" && "env" in process) { L478: r = process.env.DEBUG; L479: } ... L563: } L564: if (process.platform === "win32") { L565: const osRelease = os10.release().split(".");

dist/claude-cli/claudeView file

•path = dist/claude-cli/claude kind = native_binary sizeBytes = 245517112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/claude-cli/claudeView on unpkg

src/server/agent-server.test.tsView file

Lines 307-347typescript

307 },

308 );

309}

310

311function sessionUpdateEntry(

312 sessionUpdate: string,

313 extra: Record<string, unknown> = {},

314

Source & flagged code

7 flagged · loading source

dist/handoff-checkpoint.jsView file

905// ../git/dist/handoff.js L906: import { spawn as spawn3 } from "child_process"; L907: import { copyFile, mkdtemp, readFile as readFile2, rm as rm2, stat as stat2 } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/handoff-checkpoint.jsView on unpkg · L905

dist/server/agent-server.jsView file

20224} L20225: async function handlePostHogExecApprovalFlow(context, subTool) { L20226: const { toolName, toolInput, toolUseID, sessionId, session } = context;

High

Shell

Package source references shell execution.

dist/server/agent-server.jsView on unpkg · L20224

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server/agent-server.jsView on unpkg · L172

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/agent-server.jsView on unpkg · L172

1821var func = `(${args}) => { ${body} };`; L1822: ASM_CONSTS[start] = eval(func); L1823: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server/agent-server.jsView on unpkg · L1821

dist/claude-cli/claudeView file

•path = dist/claude-cli/claude kind = native_binary sizeBytes = 245517112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/claude-cli/claudeView on unpkg

src/server/agent-server.test.tsView file

327patternName = private_key_rsa severity = critical line = 327 matchedText = const TE...----

Critical

Secret Pattern

RSA private key in src/server/agent-server.test.ts

src/server/agent-server.test.tsView on unpkg · L327

Findings

1 Critical4 High5 Medium5 Low

CriticalSecret Patternsrc/server/agent-server.test.ts

HighChild Processdist/handoff-checkpoint.js

HighShelldist/server/agent-server.js

HighObfuscated Payload Loaderdist/server/agent-server.js

HighCross File Remote Execution Contextdist/server/agent-server.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/claude-cli/claude

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowEvaldist/server/agent-server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/handoff-checkpoint.jsView file

Lines 885-925javascript

885 },

886 get fulfilled() {

887 return status !== "pending";

888 },

889 get status() {

890 return status;

891 }

892 };

893 }

894 exports.deferred = deferred2;

895 exports.createDeferred = deferred2;

896 exports.default = deferred2;

897 }

898});

899

900// src/handoff-checkpoint.ts

901import { mkdtemp as mkdtemp2, readFile as readFile3, rm as rm3, writeFile as writeFile2 } from "fs/promises";

902import { tmpdir as tmpdir2 } from "os";

903import { dirname as dirname2, join as join3 } from "path";

904

905// ../git/dist/handoff.js

906import { spawn as spawn3 } from "child_process";

907import { copyFile, mkdtemp, readFile as readFile2, rm as rm2, stat as stat2 } from "fs/promises";

High

Child Process

Package source references child process execution.

dist/handoff-checkpoint.jsView on unpkg · L905

908import { tmpdir } from "os";

909import path4 from "path";

910

911// ../../node_modules/simple-git/dist/esm/index.js

912var import_file_exists = __toESM(require_dist(), 1);

913var import_debug = __toESM(require_src(), 1);

914var import_promise_deferred = __toESM(require_dist2(), 1);

915var import_promise_deferred2 = __toESM(require_dist2(), 1);

916import { Buffer as Buffer2 } from "buffer";

917import { spawn } from "child_process";

918import { normalize } from "path";

919import { EventEmitter } from "events";

920var __defProp2 = Object.defineProperty;

921var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;

922var __getOwnPropNames2 = Object.getOwnPropertyNames;

923var __hasOwnProp2 = Object.prototype.hasOwnProperty;

924var __esm = (fn, res) => function __init() {

925 return fn && (res = (0, fn[__getOwnPropNames2(fn)[0]])(fn = 0)), res;

dist/server/agent-server.jsView file

20224} L20225: async function handlePostHogExecApprovalFlow(context, subTool) { L20226: const { toolName, toolInput, toolUseID, sessionId, session } = context;

High

Shell

Package source references shell execution.

dist/server/agent-server.jsView on unpkg · L20224

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/server/agent-server.jsView on unpkg · L172

dist/claude-cli/claudeView file

•path = dist/claude-cli/claude kind = native_binary sizeBytes = 245517112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/claude-cli/claudeView on unpkg

src/server/agent-server.test.tsView file

Lines 307-347typescript

307 },

308 );

309}

310

311function sessionUpdateEntry(

312 sessionUpdate: string,

313 extra: Record<string, unknown> = {},

314