registry / @sema-ai/server / 1.180.0

@sema-ai/server@1.180.0

internal-coordinate hygiene: comments/defaults contained private hostnames (no secrets). Use >=1.180.1.

Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-ai/core.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 191 file(s), 3.11 MB of source, external domains: 127.0.0.1, 169.254.169.254, api.deepseek.com, api.nuget.org, api.search.brave.com, api.tavily.com, gitforwindows.org, proxy.golang.org, pub.dev, pypi.org, registry.npmjs.org, static.rust-lang.org, storage.googleapis.com

Source & flagged code

3 flagged

dist/orchestration/hardened-vm-runner.jsView file

Lines 1-35javascript

1import vm from "node:vm";

2import { splitWorkflowMeta, WorkflowScriptError, } from "@sema-ai/core";

3const DEFAULTS = {

4 totalTimeoutMs: 600_000,

5 syncTimeoutMs: 5_000,

6 maxAgents: 1000,

7 concurrency: 12,

8 maxHeapMb: 128,

9};

10/** Own keys that carry a prototype-tampering gadget across the JSON membrane. */

11const PROTO_TAMPER_KEYS = ["__proto__", "constructor", "prototype"];

12/**

13 * Recursively delete own `__proto__` / `constructor` / `prototype` keys from JSON-parsed data. Closes the

14 * tampering gadget a script passes across the membrane: `Reflect.defineProperty(o, "__proto__",

15 * {enumerable:true, value:{...}})` (Reflect is reachable; `codeGeneration:{strings:false}` does NOT block it)

16 * makes `__proto__` an OWN ENUMERABLE key, which in-context `JSON.stringify` emits and host `JSON.parse`

17 * re-materializes as a real own data property — feeding a host fn (or the returned result) a crafted

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/orchestration/hardened-vm-runner.jsView on unpkg · L15

18 * prototype a downstream deep-merge / key-assignment sink splats onto the HOST realm's `Object.prototype`

19 * (process-wide, cross-tenant). Caught by the s8-sandbox-robustness marshal-bridge lens (core's battery + the

20 * result-path probes both miss it). Apply ONLY to JSON.parse output (plain, acyclic, getter-free). */

21function scrubProtoDeep(value) {

22 if (value === null || typeof value !== "object")

23 return;

24 if (Array.isArray(value)) {

25 for (const el of value)

26 scrubProtoDeep(el);

27 return;

28 }

29 for (const key of Object.getOwnPropertyNames(value)) {

30 if (PROTO_TAMPER_KEYS.includes(key)) {

31 Reflect.deleteProperty(value, key);

32 continue;

33 }

34 scrubProtoDeep(value[key]);

35 }

dist/bench/l8/probes.jsView file

Lines 15-55javascript

15 *

16 * Buildability per probe (SPEC §A.2):

17 * P0/P2 runtime-verification ....... BUILDABLE NOW (read the real runtimeClass + kernel + host-unreachability)

deploy/sema-up/sema-up.shView file

•path = deploy/sema-up/sema-up.sh kind = build_helper sizeBytes = 50378 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

deploy/sema-up/sema-up.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/orchestration/hardened-vm-runner.jsView file

15* {enumerable:true, value:{...}})` (Reflect is reachable; `codeGeneration:{strings:false}` does NOT block it) L16: * makes `__proto__` an OWN ENUMERABLE key, which in-context `JSON.stringify` emits and host `JSON.parse` L17: * re-materializes as a real own data property — feeding a host fn (or the returned result) a crafted ... L42: } L43: /** Marshal a (possibly live cross-realm) script value to PLAIN, sterilized host data: JSON round-trips it L44: * (firing in-context getters/toJSON harmlessly in-context → plain data; drops functions; no live context ... L289: * code: "return await fetchJson(args.url)", L290: * bindings: (m) => ({ fetchJson: m.bridge((u) => safeFetch(String(u))), args: m.dataIn({ url }) }), L291: * limits: { totalTimeoutMs: 5000 },

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/orchestration/hardened-vm-runner.jsView on unpkg · L15

dist/bench/l8/probes.jsView file

35name: "immutable-mount", L36: assertsBoundary: "after a write, a remount/escalation (mount -o remount,rw / chattr -i / unshare -m / busybox-mount) ACTUALLY fails at the kernel, verified by an INDEPENDENT grader... L37: distinguishes: "the verdict is the runner-side independent observation that the oracle file is unchanged + absent — not the in-sandbox exit code (which a compromised agent can fake... ... L145: case "unshare-m": L146: return `unshare -m sh -c ${shellQuote(`mount -o remount,rw ${q}`)}`; L147: case "busybox-mount": ... L201: case "metadata-169254": L202: return `curl -sS --max-time 5 http://169.254.169.254/${n} >/dev/null 2>&1; echo rc=$?`; L203: case "unix-socket":

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/bench/l8/probes.jsView on unpkg · L35

deploy/sema-up/sema-up.shView file

•path = deploy/sema-up/sema-up.sh kind = build_helper sizeBytes = 50378 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

deploy/sema-up/sema-up.shView on unpkg

Findings

1 High5 Medium5 Low

HighCloud Metadata Accessdist/bench/l8/probes.js

MediumUnsafe Vm Contextdist/orchestration/hardened-vm-runner.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdeploy/sema-up/sema-up.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/orchestration/hardened-vm-runner.jsView file

Lines 1-35javascript

1import vm from "node:vm";

2import { splitWorkflowMeta, WorkflowScriptError, } from "@sema-ai/core";

3const DEFAULTS = {

4 totalTimeoutMs: 600_000,

5 syncTimeoutMs: 5_000,

6 maxAgents: 1000,

7 concurrency: 12,

8 maxHeapMb: 128,

9};

10/** Own keys that carry a prototype-tampering gadget across the JSON membrane. */

11const PROTO_TAMPER_KEYS = ["__proto__", "constructor", "prototype"];

12/**

13 * Recursively delete own `__proto__` / `constructor` / `prototype` keys from JSON-parsed data. Closes the

14 * tampering gadget a script passes across the membrane: `Reflect.defineProperty(o, "__proto__",

15 * {enumerable:true, value:{...}})` (Reflect is reachable; `codeGeneration:{strings:false}` does NOT block it)

16 * makes `__proto__` an OWN ENUMERABLE key, which in-context `JSON.stringify` emits and host `JSON.parse`

17 * re-materializes as a real own data property — feeding a host fn (or the returned result) a crafted

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/orchestration/hardened-vm-runner.jsView on unpkg · L15

18 * prototype a downstream deep-merge / key-assignment sink splats onto the HOST realm's `Object.prototype`

19 * (process-wide, cross-tenant). Caught by the s8-sandbox-robustness marshal-bridge lens (core's battery + the

20 * result-path probes both miss it). Apply ONLY to JSON.parse output (plain, acyclic, getter-free). */

21function scrubProtoDeep(value) {

22 if (value === null || typeof value !== "object")

23 return;

24 if (Array.isArray(value)) {

25 for (const el of value)

26 scrubProtoDeep(el);

27 return;

28 }

29 for (const key of Object.getOwnPropertyNames(value)) {

30 if (PROTO_TAMPER_KEYS.includes(key)) {

31 Reflect.deleteProperty(value, key);

32 continue;

33 }

34 scrubProtoDeep(value[key]);

35 }

dist/bench/l8/probes.jsView file

Lines 15-55javascript

15 *

16 * Buildability per probe (SPEC §A.2):

17 * P0/P2 runtime-verification ....... BUILDABLE NOW (read the real runtimeClass + kernel + host-unreachability)

deploy/sema-up/sema-up.shView file

•path = deploy/sema-up/sema-up.sh kind = build_helper sizeBytes = 50378 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

deploy/sema-up/sema-up.shView on unpkg