registry / @shogo-ai/worker / 1.13.10

@shogo-ai/worker@1.13.10

⚠ Under review

Shogo Cloud Agent Worker — run Shogo agents on your own machine (laptop, devbox, CI).

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 351 KB of source, external domains: 127.0.0.1, api.github.com, bun.sh, github.com, shogo.ai, studio.shogo.ai

Source & flagged code

7 flagged

bin/shogo.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: MIT

4//

5// `shogo` CLI entry shim. Picks an execution mode in this order:

6//

7// 1. Compiled per-platform binary at $PREFIX/dist/shogo (in the

8// tarball release — Bun bundled, no runtime deps).

9// 2. Bundled JS at ../dist/cli.mjs (npm install

10// with no Bun on PATH — Node ESM-loadable).

11// 3. Source TS at ../src/cli.ts (monorepo

12// / `bun link`ed dev, requires Bun or tsx).

13import { fileURLToPath } from 'node:url';

14import { existsSync } from 'node:fs';

15import { dirname, join } from 'node:path';

16import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const args = process.argv.slice(2);

21const compiledBin = join(__dirname, '..', 'dist', process.platform === 'win32' ? 'shogo.exe' : 'shogo');

22const distEntry = join(__dirname, '..', 'dist', 'cli.mjs');

23const srcEntry = join(__dirname, '..', 'src', 'cli.ts');

25if (existsSync(compiledBin)) {

26 const child = spawn(compiledBin, args, { stdio: 'inherit' });

27 child.on('exit', (code) => process.exit(code ?? 0));

28} else if (existsSync(distEntry)) {

29 await import(distEntry);

30} else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

31 const runner = process.versions.bun ? 'bun' : 'tsx';

32 const child = spawn(runner, [srcEntry, ...args], { stdio: 'inherit' });

33 child.on('exit', (code) => process.exit(code ?? 0));

34} else {

35 console.error('shogo: no executable entry found (looked for dist/shogo, dist/cli.mjs, src/cli.ts)');

36 console.error(' Reinstall with `npm i -g @shogo-ai/worker` or rebuild via `bun run build`.');

37 process.exit(1);

38}

src/lib/resource-limits.tsView file

Lines 205-245typescript

205 const ok = helper.limitProcess(pid, {

206 memoryBytes: limits.memoryMB * 1024 * 1024,

207 killOnClose: true,

208 });

209 if (ok) {

210 logger?.log(`[resource-limits] attached pid ${

dist/cli.mjsView file

Lines 1-21javascript

1import{createRequire as U$}from"node:module";var w$=Object.defineProperty;var L$=($)=>$;function C$($,X){this[$]=L$.bind(null,X)}var A$

Source & flagged code

7 flagged · loading source

bin/shogo.mjsView file

15import { dirname, join } from 'node:path'; L16: import { spawn } from 'node:child_process'; L17:

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

28} else if (existsSync(distEntry)) { L29: await import(distEntry); L30: } else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

src/lib/resource-limits.tsView file

225* runtime is spawned `detached`), summed across the group. L226: * - Windows: a PowerShell pass that sums WorkingSet64 of `pid` and all of its L227: * descendants (walking Win32_Process.ParentProcessId).

High

Shell

Package source references shell execution.

src/lib/resource-limits.tsView on unpkg · L225

dist/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @shogo-ai/worker@1.12.6 matchedIdentity = npm:QHNob2dvLWFpL3dvcmtlcg:1.12.6 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L1

1import{createRequire as U$}from"node:module";var w$=Object.defineProperty;var L$=($)=>$;function C$($,X){this[$]=L$.bind(null,X)}var A$=($,X)=>{for(var Y in X)w$($,Y,{get:X[Y],enum... L2: Shogo Worker — Preflight ... L13: `))if(k)this.log.log(`${W} ${k}`)}),H.stderr?.on("data",(O)=>{$.lastStdoutAt=Date.now();for(let k of O.toString().trimEnd().split(` L14: `))if(k)this.log.error(`${W} ${k}`)});try{return await this.waitForHealth($,U6),$.status="running",$.lastUsedAt=Date.now(),this.armIdleTimer($),this.armGraceTimer($),$}catch(O){$.s... L15: Shogo Worker — Starting`)),console.log(w.dim(" name ")+X.name),console.log(w.dim(" worker-dir ")+X.workerDir),console.log(w.dim(" cloud ")+X.cloudUrl),console.log(... L16: Received ${O} — shutting down...`));try{q.stop()}catch{}try{await Q.stopAll()}catch(k){console.warn(w.yellow(`stopAll: ${k?.message??k}`))}process.exit(0)};process.once("SIGINT",()... L17: Shogo Worker — Started`)),console.log(w.dim(" pid: ")+V),console.log(w.dim(" name: ")+$.name),console.log(w.dim(" logs: ")+"~/.shogo/logs/worker.log"),console.log(w.dim(" stop... L18: expected: ${H}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L1

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.mjs

HighChild Processbin/shogo.mjs

HighShellsrc/lib/resource-limits.ts

HighSame File Env Network Executiondist/cli.mjs

HighCommand Output Exfiltrationdist/cli.mjs

HighSandbox Evasion Gated Capabilitydist/cli.mjs

MediumDynamic Requirebin/shogo.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/shogo.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: MIT

4//

5// `shogo` CLI entry shim. Picks an execution mode in this order:

6//

7// 1. Compiled per-platform binary at $PREFIX/dist/shogo (in the

8// tarball release — Bun bundled, no runtime deps).

9// 2. Bundled JS at ../dist/cli.mjs (npm install

10// with no Bun on PATH — Node ESM-loadable).

11// 3. Source TS at ../src/cli.ts (monorepo

12// / `bun link`ed dev, requires Bun or tsx).

13import { fileURLToPath } from 'node:url';

14import { existsSync } from 'node:fs';

15import { dirname, join } from 'node:path';

16import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const args = process.argv.slice(2);

21const compiledBin = join(__dirname, '..', 'dist', process.platform === 'win32' ? 'shogo.exe' : 'shogo');

22const distEntry = join(__dirname, '..', 'dist', 'cli.mjs');

23const srcEntry = join(__dirname, '..', 'src', 'cli.ts');

25if (existsSync(compiledBin)) {

26 const child = spawn(compiledBin, args, { stdio: 'inherit' });

27 child.on('exit', (code) => process.exit(code ?? 0));

28} else if (existsSync(distEntry)) {

29 await import(distEntry);

30} else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

31 const runner = process.versions.bun ? 'bun' : 'tsx';

32 const child = spawn(runner, [srcEntry, ...args], { stdio: 'inherit' });

33 child.on('exit', (code) => process.exit(code ?? 0));

34} else {

35 console.error('shogo: no executable entry found (looked for dist/shogo, dist/cli.mjs, src/cli.ts)');

36 console.error(' Reinstall with `npm i -g @shogo-ai/worker` or rebuild via `bun run build`.');

37 process.exit(1);

38}

src/lib/resource-limits.tsView file

Lines 205-245typescript

205 const ok = helper.limitProcess(pid, {

206 memoryBytes: limits.memoryMB * 1024 * 1024,

207 killOnClose: true,

208 });

209 if (ok) {

210 logger?.log(`[resource-limits] attached pid ${

dist/cli.mjsView file

Lines 1-21javascript

1import{createRequire as U$}from"node:module";var w$=Object.defineProperty;var L$=($)=>$;function C$($,X){this[$]=L$.bind(null,X)}var A$