registry  /  @scrapitos/runner  /  1.0.19

@scrapitos/runner@1.0.19

Scrapit OS Core Executor and Local Agent

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 28 file(s), 417 KB of source, external domains: 2captcha.com, api.anti-captcha.com, google.com, secure-site.com, www.w3.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli/agent.jsView file
8import * as readline from 'readline'; L9: import { spawn } from 'child_process'; L10: import * as fs from 'fs';
High
Child Process

Package source references child process execution.

dist/cli/agent.jsView on unpkg · L8
24.option('-p, --port <number>', 'Port to run the agent on', '4001') L25: .option('-u, --auth-uri <uri>', 'Cloud service base URI', 'http://localhost:4000') L26: .option('-d, --daemon', 'Run agent in background as a daemon') L27: .action(async (options) => { L28: if (options.daemon && !process.env.__DETACHED__) { L29: console.log('🚀 Starting Scrapit Agent in background...'); ... L34: const err = fs.openSync(path.join(logDir, 'agent.err'), 'a'); L35: const child = spawn(process.argv[0], [...process.argv.slice(1)], { L36: detached: true,
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/agent.jsView on unpkg · L24
dist/dslExecutor/executor.jsView file
1331try { L1332: const fn = new Function('el', scriptBody); L1333: return fn(null); // No element in page-level eval
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/dslExecutor/executor.jsView on unpkg · L1331
postinstall.jsView file
22console.log('[Scrapit Runner] Running postinstall browser installation...'); L23: execSync('npx playwright install chromium', { stdio: 'inherit', env }); L24: } catch (error) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L22

Findings

5 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli/agent.js
HighShell
HighSame File Env Network Executiondist/cli/agent.js
HighRuntime Package Installpostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/dslExecutor/executor.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License