registry / @scrapitos/runner / 1.0.19

@scrapitos/runner@1.0.19

Scrapit OS Core Executor and Local Agent

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 28 file(s), 417 KB of source, external domains: 2captcha.com, api.anti-captcha.com, google.com, secure-site.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-41json

2 "name": "@scrapitos/runner",

3 "version": "1.0.19",

4 "description": "Scrapit OS Core Executor and Local Agent",

5 "main": "dist/index.js",

6 "type": "module"

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/agent.jsView file

8import * as readline from 'readline'; L9: import { spawn } from 'child_process'; L10: import * as fs from 'fs';

High

Child Process

Package source references child process execution.

dist/cli/agent.jsView on unpkg · L8

24.option('-p, --port <number>', 'Port to run the agent on', '4001') L25: .option('-u, --auth-uri <uri>', 'Cloud service base URI', 'http://localhost:4000') L26: .option('-d, --daemon', 'Run agent in background as a daemon') L27: .action(async (options) => { L28: if (options.daemon && !process.env.__DETACHED__) { L29: console.log('🚀 Starting Scrapit Agent in background...'); ... L34: const err = fs.openSync(path.join(logDir, 'agent.err'), 'a'); L35: const child = spawn(process.argv[0], [...process.argv.slice(1)], { L36: detached: true,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/agent.jsView on unpkg · L24

dist/dslExecutor/executor.jsView file

1331try { L1332: const fn = new Function('el', scriptBody); L1333: return fn(null); // No element in page-level eval

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dslExecutor/executor.jsView on unpkg · L1331

postinstall.jsView file

22console.log('[Scrapit Runner] Running postinstall browser installation...'); L23: execSync('npx playwright install chromium', { stdio: 'inherit', env }); L24: } catch (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L22

Findings

5 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/agent.js

HighShell

HighSame File Env Network Executiondist/cli/agent.js

HighRuntime Package Installpostinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/dslExecutor/executor.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/cli/agent.jsView file

Lines 1-44javascript

1#!/usr/bin/env node

2import express from 'express';

3import cors from 'cors';

4import { EventEmitter } from 'events';

5import { Runner } from '../core/runner.js';

6import { Logger } from '../utils/logger.js';

7import { Command } from 'commander';

8import * as readline from 'readline';

9import { spawn } from 'child_process';

10import * as fs from 'fs';

High

Child Process

Package source references child process execution.

dist/cli/agent.jsView on unpkg · L8

11import * as path from 'path';

12import { fileURLToPath } from 'url';

13import { ConfigManager } from '../utils/configManager.js';

14const __filename = fileURLToPath(import.meta.url);

15const __dirname = path.dirname(__filename);

16const program = new Command();

17program

18 .name('scrapit-agent')

19 .description('Local execution agent for Scrapit OS')

20 .version('1.0.0');

21program

22 .command('serve', { isDefault: true })

23 .description('Start the local agent server')

24 .option('-p, --port <number>', 'Port to run the agent on', '4001')

25 .option('-u, --auth-uri <uri>', 'Cloud service base URI', 'http://localhost:4000')

26 .option('-d, --daemon', 'Run agent in background as a daemon')

27 .action(async (options) => {

28 if (options.daemon && !process.env.__DETACHED__) {

29 console.log('🚀 Starting Scrapit Agent in background...');

30 const logDir = ConfigManager.getInstance().getLogBaseDir();

31 if (!fs.existsSync(logDir))

32 fs.mkdirSync(logDir, { recursive: true });

33 const out = fs.openSync(path.join(logDir, 'agent.log'), 'a');

34 const err = fs.openSync(path.join(logDir, 'agent.err'), 'a');

35 const child = spawn(process.argv[0], [...process.argv.slice(1)], {

36 detached: true,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/agent.jsView on unpkg · L24

37 stdio: ['ignore', out, err],

38 env: { ...process.env, __DETACHED__: 'true' }

39 });

40 child.unref();

41 process.exit();

42 }

43 await startAgent(options);

44});

dist/dslExecutor/executor.jsView file

Lines 1311-1351javascript

1311 }

1312 break;

1313 case 'storeResult':

1314 const outputKey = step.mapTo || 'fileUrl';

1315 const fileUrl = context.store.get('fileUrl');

1316 if (fileUrl) {

1317 context.store.set(outputKey, fileUrl);

1318 Logger.log(`Result mapped: ${outputKey} -> ${fileUrl}`);

1319 }

1320 break;

1321 case 'eval':

1322 if (!step.code && !value)

1323 throw new Error(`Code required for 'eval' action on ${target}`);

1324 const script = step.code || value;

1325 // If the target looks like a placeholder or isn't found in registry,

1326 // we prefer page.evaluate to avoid waiting for a non-existent element.

1327 const isPageLevel = target === 'page' || target === 'document' || target.includes('eval_step') || selector === target;

1328 if (isPageLevel) {

1329 Logger.log(`Executing page-level script...`);

1330 const result = await page.evaluate((scriptBody) => {

1331 try {

1332 const fn = new Function('el', scriptBody);

1333 return fn(null); // No element in page-level eval

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dslExecutor/executor.jsView on unpkg · L1331

1334 }

1335 catch (e) {

1336 return { error: e.message };

1337 }

1338 }, script);

1339 this.handleEvalResult(context, step, result);

1340 }

1341 else {

1342 Logger.log(`Executing custom script on ${target}...`);

1343 // We provide the element as 'el' and the current store as 'store'

1344 const result = await locator.first().evaluate((el, scriptBody) => {

1345 try {

1346 const fn = new Function('el', scriptBody);

1347 return fn(el);

1348 }

1349 catch (e) {

1350 return { error: e.message };

1351 }

postinstall.jsView file

Lines 2-28javascript

2import os from 'os';

3import fs from 'fs';

5try {

6 const env = { ...process.env };

8 if (process.platform === 'linux') {

9 try {

10 if (fs.existsSync('/etc/os-release')) {

11 const release = fs.readFileSync('/etc/os-release', 'utf8');

12 if (release.includes('Ubuntu') && release.includes('26.04')) {

13 console.log('[Scrapit Runner] Ubuntu 26.04 detected. Overriding host platform to ubuntu24.04 for Playwright compatibility.');

14 env.PLAYWRIGHT_HOST_PLATFORM_OVERRIDE = 'ubuntu24.04';

15 }

16 }

17 } catch (e) {

18 console.warn('[Scrapit Runner] Failed to read /etc/os-release', e);

19 }

20 }

22 console.log('[Scrapit Runner] Running postinstall browser installation...');

23 execSync('npx playwright install chromium', { stdio: 'inherit', env });

24} catch (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L22

25 console.error('[Scrapit Runner] Warning: Playwright browser installation failed.', error.message);

26 // Do not fail the npm install process; allow execution with host-provided chromium

27}