registry / @s-gw/s-gw / 0.1.8

@s-gw/s-gw@0.1.8

Local credential control for AI coding agents.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 1.42 MB of source, external domains: 127.0.0.1, api.github.com, github.com, opencode.ai, react.dev, www.apple.com, www.w3.org

Source & flagged code

6 flagged

dist/console-server.jsView file

Lines 882-922javascript

882 throw new HttpError(400, "Expected a finite number.");

883 }

884 return parsed;

885}

886function providerForType(type) {

887 if (type === "private-key" || type === "ssh-key") {

888 return "ssh";

889 }

890 if (type === "unknown") {

891 return "generic";

892 }

893 return type;

894}

895function providerLabel(provider) {

896 const known = {

897 aws: "AWS",

898 github: "GitHub",

899 openai: "OpenAI",

900 ssh: "SSH",

901 "1password": "1Password",

902 onepassword: "1Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L902

903 generic: "Generic",

904 keychain: "macOS Keychain",

905 "macos-keychain": "macOS Keychain",

906 "windows-credential-manager": "Windows Credential Manager",

907 "api-token": "API Tokens",

908 credential: "Credentials"

909 };

910 return known[provider] || provider.replace(/(^|-)([a-z])/g, (_match, dash, char) => {

911 return `${dash ? " " : ""}${char.toUpperCase()}`;

912 });

913}

914function handlePrefix(provider, type) {

915 if (provider && provider !== "generic") {

916 return `s-gw:${provider}`;

917 }

918 return `s-gw:${type}`;

919}

920function higherSeverity(a, b) {

921 const rank = {

922 low: 0,

dist/install.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { accessSync, constants, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";

4import { mkdir, rm, writeFile } from "node:fs/promises";

5import os from "node:os";

dist/native/darwin-arm64/s-gw-coreView file

•path = dist/native/darwin-arm64/s-gw-core kind = native_binary sizeBytes = 495392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-coreView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/package-update.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @s-gw/s-gw@0.1.5 matchedIdentity = npm:QHMtZ3cvcy1ndw:0.1.5 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/package-update.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/console-server.jsView file

902patternName = generic_password severity = medium line = 902 matchedText = onepassw...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L902

dist/install.jsView file

1import { spawn, spawnSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L14: const packageRoot = path.basename(here) === "dist" ? path.dirname(here) : path.dirname(here); L15: const nativeTarget = `${process.platform}-${process.arch}`; L16: const packagedMacAppPath = path.join(packageRoot, "dist", "s-gw.app"); ... L146: requireMac("macOS app stop"); L147: if (process.env.SGW_SKIP_APP_STOP === "1") L148: return undefined; ... L164: if (result.status !== 0) { L165: throw new Error(result.stderr.trim() || "Could not close the running s-gw macOS app."); L166: } L167: const parsed = JSON.parse(result.stdout.trim() || "[]");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/install.jsView on unpkg · L1

dist/native/darwin-arm64/s-gw-coreView file

•path = dist/native/darwin-arm64/s-gw-core kind = native_binary sizeBytes = 495392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-coreView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/package-update.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/package-update.jsView on unpkg

Findings

2 High8 Medium5 Low

HighShips High Entropy Blobdist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2

HighPrevious Version Dangerous Deltadist/package-update.js

MediumSecret Patterndist/console-server.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/install.js

MediumProtestware

MediumShips Native Binarydist/native/darwin-arm64/s-gw-core

MediumShips Build Helperdist/windows/s-gw-client.ps1

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/console-server.jsView file

Lines 882-922javascript

882 throw new HttpError(400, "Expected a finite number.");

883 }

884 return parsed;

885}

886function providerForType(type) {

887 if (type === "private-key" || type === "ssh-key") {

888 return "ssh";

889 }

890 if (type === "unknown") {

891 return "generic";

892 }

893 return type;

894}

895function providerLabel(provider) {

896 const known = {

897 aws: "AWS",

898 github: "GitHub",

899 openai: "OpenAI",

900 ssh: "SSH",

901 "1password": "1Password",

902 onepassword: "1Password",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/console-server.jsView on unpkg · L902

903 generic: "Generic",

904 keychain: "macOS Keychain",

905 "macos-keychain": "macOS Keychain",

906 "windows-credential-manager": "Windows Credential Manager",

907 "api-token": "API Tokens",

908 credential: "Credentials"

909 };

910 return known[provider] || provider.replace(/(^|-)([a-z])/g, (_match, dash, char) => {

911 return `${dash ? " " : ""}${char.toUpperCase()}`;

912 });

913}

914function handlePrefix(provider, type) {

915 if (provider && provider !== "generic") {

916 return `s-gw:${provider}`;

917 }

918 return `s-gw:${type}`;

919}

920function higherSeverity(a, b) {

921 const rank = {

922 low: 0,

dist/install.jsView file

Lines 1-21javascript

1import { spawn, spawnSync } from "node:child_process";

2import { createHash } from "node:crypto";

3import { accessSync, constants, existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";

4import { mkdir, rm, writeFile } from "node:fs/promises";

5import os from "node:os";

dist/native/darwin-arm64/s-gw-coreView file

•path = dist/native/darwin-arm64/s-gw-core kind = native_binary sizeBytes = 495392 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/darwin-arm64/s-gw-coreView on unpkg

dist/windows/s-gw-client.ps1View file

•path = dist/windows/s-gw-client.ps1 kind = build_helper sizeBytes = 2736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/windows/s-gw-client.ps1View on unpkg

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View file

•path = dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2 kind = high_entropy_blob sizeBytes = 15084 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/console-ui/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2View on unpkg

dist/package-update.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/package-update.jsView on unpkg