registry / @s-gw/s-gw / 0.1.19

@s-gw/s-gw@0.1.19

Local credential control for AI coding agents.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 1.60 MB of source, external domains: 127.0.0.1, api.github.com, github.com, opencode.ai, react.dev, www.apple.com, www.w3.org

Source & flagged code

6 flagged

dist/console-server.jsView file

Lines 1113-1153javascript

1113}

1114function hasBodyField(body, field) {

1115 return Object.prototype.hasOwnProperty.call(body, field);

1116}

1117function providerForType(type) {

1118 if (type === "private-key" || type === "ssh-key") {

1119 return "ssh";

1120 }

1121 if (type === "unknown") {

1122 return "generic";

1123 }

1124 return type;

1125}

1126function providerLabel(provider) {

1127 const known = {

1128 aws: "AWS",

1129 github: "GitHub",

1130 openai: "OpenAI",

1131 ssh: "SSH",

1132 "1password": "1Password",

1133 onepassword: "1Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L1133

1134 generic: "Generic",

1135 keychain: "macOS Keychain",

1136 "macos-keychain": "macOS Keychain",

1137 "windows-credential-manager": "Windows Credential Manager",

1138 "api-token": "API Tokens",

1139 credential: "Credentials"

1140 };

1141 return known[provider] || provider.replace(/(^|-)([a-z])/g, (_match, dash, char) => {

1142 return `${dash ? " " : ""}${char.toUpperCase()}`;

1143 });

1144}

1145function handlePrefix(provider, type) {

1146 if (provider && provider !== "generic") {

1147 return `s-gw:${provider}`;

1148 }

1149 return `s-gw:${type}`;

1150}

1151function higherSeverity(a, b) {

1152 const rank = {

1153 low: 0,

dist/install.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { accessSync, constants, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";

4import { mkdir, rm, writeFile } from "node:fs/promises"

dist/native/darwin-arm64/s-gw-keychain-inspectorView file

•path = dist/native/darwin-arm64/s-gw-keychain-inspector kind = native_binary sizeBytes = 85016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-keychain-inspectorView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/s-gw Menu Bar.app/Contents/Resources/AppIcon.icnsView file

•path = dist/s-gw Menu Bar.app/Contents/Resources/AppIcon.icns kind = high_entropy_blob sizeBytes = 1200637 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/s-gw Menu Bar.app/Contents/Resources/AppIcon.icnsView on unpkg

Source & flagged code

6 flagged · loading source

dist/console-server.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code