registry / @sema-agent/server / 1.193.0

@sema-agent/server@1.193.0

Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 192 file(s), 1.68 MB of source, external domains: 127.0.0.1, 169.254.169.254, api.deepseek.com, api.nuget.org, api.search.brave.com, api.tavily.com, gitforwindows.org, proxy.golang.org, pub.dev, pypi.org, registry.npmjs.org, static.rust-lang.org, storage.googleapis.com

Source & flagged code

4 flagged

dist/orchestration/hardened-vm-runner.jsView file

Lines 7-47javascript

7 concurrency: 12,

8 maxHeapMb: 128,

9};

10const PROTO_TAMPER_KEYS = ["__proto__", "constructor", "prototype"];

11function

Source & flagged code

4 flagged · loading source

dist/orchestration/hardened-vm-runner.jsView file

27function sterilizingParse(json) { L28: const parsed = JSON.parse(json); L29: scrubProtoDeep(parsed); ... L210: return runHardened({ L211: body: opts.code, L212: buildGlobals: opts.bindings ?? (() => ({})),

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/orchestration/hardened-vm-runner.jsView on unpkg · L27

dist/bench/l8/probes.jsView file

13name: "immutable-mount", L14: assertsBoundary: "after a write, a remount/escalation (mount -o remount,rw / chattr -i / unshare -m / busybox-mount) ACTUALLY fails at the kernel, verified by an INDEPENDENT grader... L15: distinguishes: "the verdict is the runner-side independent observation that the oracle file is unchanged + absent — not the in-sandbox exit code (which a compromised agent can fake... ... L105: case "unshare-m": L106: return `unshare -m sh -c ${shellQuote(`mount -o remount,rw ${q}`)}`; L107: case "busybox-mount": ... L148: case "metadata-169254": L149: return `curl -sS --max-time 5 http://169.254.169.254/${n} >/dev/null 2>&1; echo rc=$?`; L150: case "unix-socket":

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/bench/l8/probes.jsView on unpkg · L13

deploy/sema-up/sema-up.shView file

•path = deploy/sema-up/sema-up.sh kind = build_helper sizeBytes = 50380 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

deploy/sema-up/sema-up.shView on unpkg

dist/http/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sema-agent/server@1.192.0 matchedIdentity = npm:QHNlbWEtYWdlbnQvc2VydmVy:1.192.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/http/server.jsView on unpkg

Findings

2 High5 Medium5 Low

HighCloud Metadata Accessdist/bench/l8/probes.js

HighPrevious Version Dangerous Deltadist/http/server.js

MediumUnsafe Vm Contextdist/orchestration/hardened-vm-runner.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdeploy/sema-up/sema-up.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/bench/l8/probes.jsView file

Lines 1-33javascript

1import { shellQuote } from "../../plugins/remote-shell.js";

2export const REAL_ISOLATION_RUNTIME_CLASSES = ["kata-qemu", "kata-fc", "kata"];

3export const PROBE_MATRIX = [

4 {

5 id: "P0",

6 name: "runtime-verification",

7 assertsBoundary: "the pod's ACTUAL runtimeClass is a real isolation runtime (kata-qemu) AND (kata) the guest kernel != host kernel",

8 distinguishes: "reads the real runtimeClass + uname + systemd-detect-virt; NEVER trusts capabilities.isolation:true. A runc downgrade reports isolation:true but runtimeClass='' and guestKernel===hostKernel → classified runc (lying-adapter caught).",

9 buildable: "now",

10 },

11 {

12 id: "P1",

13 name: "immutable-mount",

14 assertsBoundary: "after a write, a remount/escalation (mount -o remount,rw / chattr -i / unshare -m / busybox-mount) ACTUALLY fails at the kernel, verified by an INDEPENDENT grader (inode/hash), not the agent's stdout",

15 distinguishes: "the verdict is the runner-side independent observation that the oracle file is unchanged + absent — not the in-sandbox exit code (which a compromised agent can fake).",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/bench/l8/probes.jsView on unpkg · L13

16 buildable: "pending-adapter-seam",

17 blocker: "The additive podSpecPatch seam is now MERGED (remote-env-k8s.ts applyPodSpecPatch + K8sEnvConfig.podSpecPatch — ruled service-side, the SAME seam graderEnvFactory needs). P1's REMAINING gap is the LIVE runner: provision a Kata sandbox WITH the RO-mount podSpecPatch, attempt the escalations, and have the INDEPENDENT grader verify the oracle file is unchanged. Until that live run wires the seam, p1Mode='adapter-RO-seam-absent' and gC stays false on the P1 axis.",

18 },

19 {

20 id: "P2",

21 name: "isolation",

22 assertsBoundary: "host fs / k8s SA-token / kube-apiserver all unreachable AND (kata) guest kernel distinct from host (design/53 lethal-trifecta contained)",

23 distinguishes: "real host-unreachability + kernel-inequality are kernel/VM facts; recorded backend-specific (kata uses kernel-inequality, e2b uses the Firecracker kernel string — NO kernel-vs-host assert on e2b). SA-token absence is a DISTINCT defense-in-depth field, not folded into the VM-isolation verdict (a runc pod with automount:false also lacks it).",

24 buildable: "now",

25 },

26 {

27 id: "P3",

28 name: "egress+bash-bypass",

29 assertsBoundary: "a bash-issued egress to a non-allowlisted host (DNS/UDP/IPv6/metadata-169.254.169.254/unix-socket) is blocked by the REAL net boundary, observed by an EXTERNAL collector (per-run nonce), while an allowlisted host still works",

30 distinguishes: "verdict from the EXTERNAL collector nonce log, NEVER the in-sandbox exit code (an exfil that succeeds but reports failure is the worst case). Against the CURRENT boundary this HONESTLY reports egressEnforced:false — no NetworkPolicy + E2B allowInternetAccess:true — a real G-c-blocking finding, not a fake-green.",

31 buildable: "pending-cni",

32 blocker: "NO egress NetworkPolicy in the repo; E2B defaults allowInternetAccess:true (remote-env-e2b.ts:186). k3s default flannel does NOT enforce egress NetworkPolicy (needs Cilium/Calico) — cluster CNI is an OPEN QUESTION (center). With no enforcement P3 CANNOT pass; egressEnforced:false keeps tier-ON NO-GO (design/93 N3).",

33 },