registry / @sep-agent/magnus / 1.0.13

@sep-agent/magnus@1.0.13

Magnus local source server, side panel UI, and Chrome extension shell.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 1.60 MB of source, external domains: 127.0.0.1, aaabg.com, api.deepseek.com, api.openai.com, local.invalid, registry.npmjs.org, vuejs.org, www.w3.org

Source & flagged code

8 flagged

package/js/service-worker.jsView file

Lines 574-614javascript

574 return; // 早返回

575 }

576 // 默认执行函数注入

577 let args = message.args || [message.params];

578 const execData = fillIframeTarget(

579 message,

580 sender,

581 { function: injectScript, args, world }

582 );

583 chrome.scripting.executeScript(execData).then(result => {

584 console.log(result, 'executeScript-result');

585 sendResponse(result);

586 });

587}

588/**

589 * 执行注入的函数

590 * @param {Object} params - 参数对象

591 */

592function injectScript(params) {

593 if (!params) return;

594 if (params.type === "eval" && params.value) {

595 return eval(params.value);

596 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

package/js/service-worker.jsView on unpkg · L594

597}

598/**

599 * 填充 iframe/tab 信息，生成 chrome.scripting.executeScript 所需对象

600 * @param {Object} message - 消息对象

601 * @param {Object} sender - 消息发送者

602 * @param {Object} execData - 执行数据对象

603 * @returns {Object} 带 target 信息的执行数据

604 */

605function fillIframeTarget(message, sender, execData) {

606 // iframe id 优先使用 message.myIframeId，否则用 sender.frameId

607 let frameId = message.myIframeId || sender.frameId;

608 let frameIds = frameId ? [frameId] : undefined;

609

610 // tab id

611 let tabId = message?.tabId || (sender?.tab && sender?.tab?.id);

612 if(!tabId) return execData; // 如果没有 tabId，直接返回 execData

613 // 填充 target

614 execData.target = { tabId };

bin/magnus.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

4// Magnus CLI —— 本地 source-server 管理 + Chrome 插件目录辅助安装。

5// 登录即起、崩溃自愈、更新自重启（KeepAlive）。命令：install / uninstall / start / stop / restart / status / chrome / version。

7const fs = require('fs');

8const os = require('os');

scripts/source-server/experience/task-session.jsView file

Lines 1-21javascript

1const crypto = require('crypto');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/source-server/experience/task-session.jsView on unpkg · L1

3const sessions = new Map();

4const RECENT_INPUT_LIMIT =

scripts/source-server/update/update-service.jsView file

Lines 1-25javascript

1'use strict';

3// 更新服务：读取当前包版本、查 npm registry 有无新版、执行全局更新并退出（靠 launchd KeepAlive 自重启）。

4// 查询用的是 update-notifier 底层同款逻辑（registry 的 dist-tags.latest + semver 比较），不额外引依赖、可控。

6const https = require('https');

7const fs = require('fs');

package/app/package.zipView file

•path = package/app/package.zip kind = high_entropy_blob sizeBytes = 87684 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

package/app/package.zipView on unpkg

•path = package/app/package.zip kind = compressed_blob sizeBytes = 87684 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

package/app/package.zipView on unpkg

•path = package/app/package.zip kind = nested_archive_needs_inspection sizeBytes = 87684 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

package/app/package.zipView on unpkg

Source & flagged code

8 flagged · loading source

package/js/service-worker.jsView file

594if (params.type === "eval" && params.value) { L595: return eval(params.value); L596: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

package/js/service-worker.jsView on unpkg · L594

bin/magnus.jsView file

6L7: const fs = require('fs'); L8: const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/magnus.jsView on unpkg · L6

9const path = require('path'); L10: const http = require('http'); L11: const { spawn, spawnSync } = require('child_process'); L12: L13: const LABEL = 'com.magnus.source-server'; L14: const packageRoot = path.resolve(__dirname, '..'); L15: const serverScript = path.join(packageRoot, 'scripts', 'source-server.js'); ... L24: const chromeManifestPath = path.join(chromeExtensionDir, 'manifest.json'); L25: const packageJsonPath = path.join(packageRoot, 'package.json'); L26: L27: const HOST = process.env.MAGNUS_SOURCE_HOST || '127.0.0.1'; L28: const PORT = Number(argValue('--port') || process.env.MAGNUS_SOURCE_PORT || 17321);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/magnus.jsView on unpkg · L9

scripts/source-server/experience/task-session.jsView file

1const crypto = require('crypto'); L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/source-server/experience/task-session.jsView on unpkg · L1

scripts/source-server/update/update-service.jsView file

5L6: const https = require('https'); L7: const fs = require('fs'); L8: const path = require('path'); L9: const { spawn } = require('child_process'); L10: L11: const rootDir = path.resolve(__dirname, '..', '..', '..'); L12: const updateState = { ... L16: finishedAt: 0, L17: exitCode: null, L18: error: '', ... L43: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/source-server/update/update-service.jsView on unpkg · L5

package/app/package.zipView file

•path = package/app/package.zip kind = high_entropy_blob sizeBytes = 87684 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

package/app/package.zipView on unpkg

•path = package/app/package.zip kind = compressed_blob sizeBytes = 87684 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

package/app/package.zipView on unpkg

•path = package/app/package.zip kind = nested_archive_needs_inspection sizeBytes = 87684 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

package/app/package.zipView on unpkg

Findings

2 High6 Medium7 Low

HighSandbox Evasion Gated Capabilityscripts/source-server/update/update-service.js

HighShips High Entropy Blobpackage/app/package.zip

MediumDynamic Requirebin/magnus.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/magnus.js

MediumShips Compressed Blobpackage/app/package.zip

MediumStructural Risk Force Deep Review

LowEvalpackage/js/service-worker.js

LowWeak Cryptoscripts/source-server/experience/task-session.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionpackage/app/package.zip

Source & flagged code

8 flagged

package/js/service-worker.jsView file

Lines 574-614javascript

574 return; // 早返回

575 }

576 // 默认执行函数注入

577 let args = message.args || [message.params];

578 const execData = fillIframeTarget(

579 message,

580 sender,

581 { function: injectScript, args, world }

582 );

583 chrome.scripting.executeScript(execData).then(result => {

584 console.log(result, 'executeScript-result');

585 sendResponse(result);

586 });

587}

588/**

589 * 执行注入的函数

590 * @param {Object} params - 参数对象

591 */

592function injectScript(params) {

593 if (!params) return;

594 if (params.type === "eval" && params.value) {

595 return eval(params.value);

596 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

package/js/service-worker.jsView on unpkg · L594

597}

598/**

599 * 填充 iframe/tab 信息，生成 chrome.scripting.executeScript 所需对象

600 * @param {Object} message - 消息对象

601 * @param {Object} sender - 消息发送者

602 * @param {Object} execData - 执行数据对象

603 * @returns {Object} 带 target 信息的执行数据

604 */

605function fillIframeTarget(message, sender, execData) {

606 // iframe id 优先使用 message.myIframeId，否则用 sender.frameId

607 let frameId = message.myIframeId || sender.frameId;

608 let frameIds = frameId ? [frameId] : undefined;

609

610 // tab id

611 let tabId = message?.tabId || (sender?.tab && sender?.tab?.id);

612 if(!tabId) return execData; // 如果没有 tabId，直接返回 execData

613 // 填充 target

614 execData.target = { tabId };

bin/magnus.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

4// Magnus CLI —— 本地 source-server 管理 + Chrome 插件目录辅助安装。

5// 登录即起、崩溃自愈、更新自重启（KeepAlive）。命令：install / uninstall / start / stop / restart / status / chrome / version。

7const fs = require('fs');

8const os = require('os');

scripts/source-server/experience/task-session.jsView file

Lines 1-21javascript

1const crypto = require('crypto');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/source-server/experience/task-session.jsView on unpkg · L1

3const sessions = new Map();

4const RECENT_INPUT_LIMIT =

scripts/source-server/update/update-service.jsView file

Lines 1-25javascript

1'use strict';

3// 更新服务：读取当前包版本、查 npm registry 有无新版、执行全局更新并退出（靠 launchd KeepAlive 自重启）。

4// 查询用的是 update-notifier 底层同款逻辑（registry 的 dist-tags.latest + semver 比较），不额外引依赖、可控。

6const https = require('https');

7const fs = require('fs');

package/app/package.zipView file

•path = package/app/package.zip kind = high_entropy_blob sizeBytes = 87684 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

package/app/package.zipView on unpkg

•path = package/app/package.zip kind = compressed_blob sizeBytes = 87684 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

package/app/package.zipView on unpkg

•path = package/app/package.zip kind = nested_archive_needs_inspection sizeBytes = 87684 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

package/app/package.zipView on unpkg