registry / @s-gw/s-gw / 0.1.3

@s-gw/s-gw@0.1.3

Local credential control for AI coding agents.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 1.41 MB of source, external domains: 127.0.0.1, api.github.com, github.com, opencode.ai, react.dev, www.apple.com, www.w3.org

Source & flagged code

5 flagged

dist/console-server.jsView file

Lines 882-922javascript

882 throw new HttpError(400, "Expected a finite number.");

883 }

884 return parsed;

885}

886function providerForType(type) {

887 if (type === "private-key" || type === "ssh-key") {

888 return "ssh";

889 }

890 if (type === "unknown") {

891 return "generic";

892 }

893 return type;

894}

895function providerLabel(provider) {

896 const known = {

897 aws: "AWS",

898 github: "GitHub",

899 openai: "OpenAI",

900 ssh: "SSH",

901 "1password": "1Password",

902 onepassword: "1Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L902

903 generic: "Generic",

904 keychain: "macOS Keychain",

905 "macos-keychain": "macOS Keychain",

906 "windows-credential-manager": "Windows Credential Manager",

907 "api-token": "API Tokens",

908 credential: "Credentials"

909 };

910 return known[provider] || provider.replace(/(^|-)([a-z])/g, (_match, dash, char) => {

911 return `${dash ? " " : ""}${char.toUpperCase()}`;

912 });

913}

914function handlePrefix(provider, type) {

915 if (provider && provider !== "generic") {

916 return `s-gw:${provider}`;

917 }

918 return `s-gw:${type}`;

919}

920function higherSeverity(a, b) {

921 const rank = {

922 low: 0,

dist/native/darwin-arm64/s-gw-coreView file

•path = dist/native/darwin-arm64/s-gw-core kind = native_binary sizeBytes = 495392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-coreView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/executor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @s-gw/s-gw@0.1.2 matchedIdentity = npm:QHMtZ3cvcy1ndw:0.1.2 similarity = 0.731 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/executor.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/console-server.jsView file

902patternName = generic_password severity = medium line = 902 matchedText = onepassw...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L902

dist/native/darwin-arm64/s-gw-coreView file

•path = dist/native/darwin-arm64/s-gw-core kind = native_binary sizeBytes = 495392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-coreView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/executor.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/executor.jsView on unpkg

Findings

2 High7 Medium5 Low

HighShips High Entropy Blobdist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2

HighPrevious Version Dangerous Deltadist/executor.js

MediumSecret Patterndist/console-server.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarydist/native/darwin-arm64/s-gw-core

MediumShips Build Helperdist/windows/s-gw-client.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/console-server.jsView file

Lines 882-922javascript

882 throw new HttpError(400, "Expected a finite number.");

883 }

884 return parsed;

885}

886function providerForType(type) {

887 if (type === "private-key" || type === "ssh-key") {

888 return "ssh";

889 }

890 if (type === "unknown") {

891 return "generic";

892 }

893 return type;

894}

895function providerLabel(provider) {

896 const known = {

897 aws: "AWS",

898 github: "GitHub",

899 openai: "OpenAI",

900 ssh: "SSH",

901 "1password": "1Password",

902 onepassword: "1Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L902

903 generic: "Generic",

904 keychain: "macOS Keychain",

905 "macos-keychain": "macOS Keychain",

906 "windows-credential-manager": "Windows Credential Manager",

907 "api-token": "API Tokens",

908 credential: "Credentials"

909 };

910 return known[provider] || provider.replace(/(^|-)([a-z])/g, (_match, dash, char) => {

911 return `${dash ? " " : ""}${char.toUpperCase()}`;

912 });

913}

914function handlePrefix(provider, type) {

915 if (provider && provider !== "generic") {

916 return `s-gw:${provider}`;

917 }

918 return `s-gw:${type}`;

919}

920function higherSeverity(a, b) {

921 const rank = {

922 low: 0,

dist/native/darwin-arm64/s-gw-coreView file

•path = dist/native/darwin-arm64/s-gw-core kind = native_binary sizeBytes = 495392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-coreView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/executor.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/executor.jsView on unpkg