registry / @shogo-ai/worker / 1.12.3

@shogo-ai/worker@1.12.3

Shogo Cloud Agent Worker — run Shogo agents on your own machine (laptop, devbox, CI).

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 30 file(s), 326 KB of source, external domains: 127.0.0.1, api.github.com, bun.sh, github.com, shogo.ai, studio.shogo.ai

Source & flagged code

5 flagged

bin/shogo.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: MIT

4//

5// `shogo` CLI entry shim. Picks an execution mode in this order:

6//

7// 1. Compiled per-platform binary at $PREFIX/dist/shogo (in the

8// tarball release — Bun bundled, no runtime deps).

9// 2. Bundled JS at ../dist/cli.mjs (npm install

10// with no Bun on PATH — Node ESM-loadable).

11// 3. Source TS at ../src/cli.ts (monorepo

12// / `bun link`ed dev, requires Bun or tsx).

13import { fileURLToPath } from 'node:url';

14import { existsSync } from 'node:fs';

15import { dirname, join } from 'node:path';

16import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const args = process.argv.slice(2);

21const compiledBin = join(__dirname, '..', 'dist', process.platform === 'win32' ? 'shogo.exe' : 'shogo');

22const distEntry = join(__dirname, '..', 'dist', 'cli.mjs');

23const srcEntry = join(__dirname, '..', 'src', 'cli.ts');

25if (existsSync(compiledBin)) {

26 const child = spawn(compiledBin, args, { stdio: 'inherit' });

27 child.on('exit', (code) => process.exit(code ?? 0));

28} else if (existsSync(distEntry)) {

29 await import(distEntry);

30} else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

31 const runner = process.versions.bun ? 'bun' : 'tsx';

32 const child = spawn(runner, [srcEntry, ...args], { stdio: 'inherit' });

33 child.on('exit', (code) => process.exit(code ?? 0));

34} else {

35 console.error('shogo: no executable entry found (looked for dist/shogo, dist/cli.mjs, src/cli.ts)');

36 console.error(' Reinstall with `npm i -g @shogo-ai/worker` or rebuild via `bun run build`.');

37 process.exit(1);

38}

dist/cli.mjsView file

Lines 1-21javascript

1import{createRequire as V$}from"node:module";var Z$=Object.defineProperty;var z$=($)=>$;function J$($,X){this[$]=z$.bind(null,X)}var K$

Source & flagged code

5 flagged · loading source

bin/shogo.mjsView file

15import { dirname, join } from 'node:path'; L16: import { spawn } from 'node:child_process'; L17:

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

28} else if (existsSync(distEntry)) { L29: await import(distEntry); L30: } else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

dist/cli.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L1

1import{createRequire as V$}from"node:module";var Z$=Object.defineProperty;var z$=($)=>$;function J$($,X){this[$]=z$.bind(null,X)}var K$=($,X)=>{for(var Y in X)Z$($,Y,{get:X[Y],enum... L2: Shogo Worker — Preflight ... L12: `))if(H)this.log.log(`${Q} ${H}`)}),q.stderr?.on("data",(V)=>{$.lastStdoutAt=Date.now();for(let H of V.toString().trimEnd().split(` L13: `))if(H)this.log.error(`${Q} ${H}`)});try{return await this.waitForHealth($,J6),$.status="running",$.lastUsedAt=Date.now(),this.armIdleTimer($),this.armGraceTimer($),$}catch(V){$.s... L14: Shogo Worker — Starting`)),console.log(G.dim(" name ")+X.name),console.log(G.dim(" worker-dir ")+X.workerDir),console.log(G.dim(" cloud ")+X.cloudUrl),console.log(... L15: Received ${W} — shutting down...`));try{V.stop()}catch{}try{await Q.stopAll()}catch(C){console.warn(G.yellow(`stopAll: ${C?.message??C}`))}process.exit(0)};process.once("SIGINT",()... L16: Shogo Worker — Started`)),console.log(G.dim(" pid: ")+q),console.log(G.dim(" name: ")+$.name),console.log(G.dim(" logs: ")+"~/.shogo/logs/worker.log"),console.log(G.dim(" stop... L17: expected: ${H}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L1

Findings

5 High4 Medium5 Low

HighChild Processbin/shogo.mjs

HighShell

HighSame File Env Network Executiondist/cli.mjs

HighCommand Output Exfiltrationdist/cli.mjs

HighSandbox Evasion Gated Capabilitydist/cli.mjs

MediumDynamic Requirebin/shogo.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/shogo.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: MIT

4//

5// `shogo` CLI entry shim. Picks an execution mode in this order:

6//

7// 1. Compiled per-platform binary at $PREFIX/dist/shogo (in the

8// tarball release — Bun bundled, no runtime deps).

9// 2. Bundled JS at ../dist/cli.mjs (npm install

10// with no Bun on PATH — Node ESM-loadable).

11// 3. Source TS at ../src/cli.ts (monorepo

12// / `bun link`ed dev, requires Bun or tsx).

13import { fileURLToPath } from 'node:url';

14import { existsSync } from 'node:fs';

15import { dirname, join } from 'node:path';

16import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const args = process.argv.slice(2);

21const compiledBin = join(__dirname, '..', 'dist', process.platform === 'win32' ? 'shogo.exe' : 'shogo');

22const distEntry = join(__dirname, '..', 'dist', 'cli.mjs');

23const srcEntry = join(__dirname, '..', 'src', 'cli.ts');

25if (existsSync(compiledBin)) {

26 const child = spawn(compiledBin, args, { stdio: 'inherit' });

27 child.on('exit', (code) => process.exit(code ?? 0));

28} else if (existsSync(distEntry)) {

29 await import(distEntry);

30} else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

31 const runner = process.versions.bun ? 'bun' : 'tsx';

32 const child = spawn(runner, [srcEntry, ...args], { stdio: 'inherit' });

33 child.on('exit', (code) => process.exit(code ?? 0));

34} else {

35 console.error('shogo: no executable entry found (looked for dist/shogo, dist/cli.mjs, src/cli.ts)');

36 console.error(' Reinstall with `npm i -g @shogo-ai/worker` or rebuild via `bun run build`.');

37 process.exit(1);

38}

dist/cli.mjsView file

Lines 1-21javascript

1import{createRequire as V$}from"node:module";var Z$=Object.defineProperty;var z$=($)=>$;function J$($,X){this[$]=z$.bind(null,X)}var K$