registry / @shogo-ai/worker / 1.13.5

@shogo-ai/worker@1.13.5

⚠ Under review

Shogo Cloud Agent Worker — run Shogo agents on your own machine (laptop, devbox, CI).

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 327 KB of source, external domains: 127.0.0.1, api.github.com, bun.sh, github.com, shogo.ai, studio.shogo.ai

Source & flagged code

6 flagged

bin/shogo.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: MIT

4//

5// `shogo` CLI entry shim. Picks an execution mode in this order:

6//

7// 1. Compiled per-platform binary at $PREFIX/dist/shogo (in the

8// tarball release — Bun bundled, no runtime deps).

9// 2. Bundled JS at ../dist/cli.mjs (npm install

10// with no Bun on PATH — Node ESM-loadable).

11// 3. Source TS at ../src/cli.ts (monorepo

12// / `bun link`ed dev, requires Bun or tsx).

13import { fileURLToPath } from 'node:url';

14import { existsSync } from 'node:fs';

15import { dirname, join } from 'node:path';

16import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const args = process.argv.slice(2);

21const compiledBin = join(__dirname, '..', 'dist', process.platform === 'win32' ? 'shogo.exe' : 'shogo');

22const distEntry = join(__dirname, '..', 'dist', 'cli.mjs');

23const srcEntry = join(__dirname, '..', 'src', 'cli.ts');

25if (existsSync(compiledBin)) {

26 const child = spawn(compiledBin, args, { stdio: 'inherit' });

27 child.on('exit', (code) => process.exit(code ?? 0));

28} else if (existsSync(distEntry)) {

29 await import(distEntry);

30} else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

31 const runner = process.versions.bun ? 'bun' : 'tsx';

32 const child = spawn(runner, [srcEntry, ...args], { stdio: 'inherit' });

33 child.on('exit', (code) => process.exit(code ?? 0));

34} else {

35 console.error('shogo: no executable entry found (looked for dist/shogo, dist/cli.mjs, src/cli.ts)');

36 console.error(' Reinstall with `npm i -g @shogo-ai/worker` or rebuild via `bun run build`.');

37 process.exit(1);

38}

dist/cli.mjsView file

Lines 1-21javascript

1import{createRequire as w$}from"node:module";var z$=Object.defineProperty;var K$=($)=>$;function J$($,X){this[$]=K$.bind(null,X)}var V$

Source & flagged code

6 flagged · loading source

bin/shogo.mjsView file

15import { dirname, join } from 'node:path'; L16: import { spawn } from 'node:child_process'; L17:

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

28} else if (existsSync(distEntry)) { L29: await import(distEntry); L30: } else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

dist/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @shogo-ai/worker@1.12.6 matchedIdentity = npm:QHNob2dvLWFpL3dvcmtlcg:1.12.6 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.mjsView on unpkg · L1

1import{createRequire as w$}from"node:module";var z$=Object.defineProperty;var K$=($)=>$;function J$($,X){this[$]=K$.bind(null,X)}var V$=($,X)=>{for(var Y in X)z$($,Y,{get:X[Y],enum... L2: Shogo Worker — Preflight ... L12: `))if(Q)this.log.log(`${w} ${Q}`)}),V.stderr?.on("data",(q)=>{$.lastStdoutAt=Date.now();for(let Q of q.toString().trimEnd().split(` L13: `))if(Q)this.log.error(`${w} ${Q}`)});try{return await this.waitForHealth($,J6),$.status="running",$.lastUsedAt=Date.now(),this.armIdleTimer($),this.armGraceTimer($),$}catch(q){$.s... L14: Shogo Worker — Starting`)),console.log(O.dim(" name ")+X.name),console.log(O.dim(" worker-dir ")+X.workerDir),console.log(O.dim(" cloud ")+X.cloudUrl),console.log(... L15: Received ${W} — shutting down...`));try{q.stop()}catch{}try{await w.stopAll()}catch(G){console.warn(O.yellow(`stopAll: ${G?.message??G}`))}process.exit(0)};process.once("SIGINT",()... L16: Shogo Worker — Started`)),console.log(O.dim(" pid: ")+V),console.log(O.dim(" name: ")+$.name),console.log(O.dim(" logs: ")+"~/.shogo/logs/worker.log"),console.log(O.dim(" stop... L17: expected: ${Q}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.mjsView on unpkg · L1

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli.mjs

HighChild Processbin/shogo.mjs

HighShell

HighSame File Env Network Executiondist/cli.mjs

HighCommand Output Exfiltrationdist/cli.mjs

HighSandbox Evasion Gated Capabilitydist/cli.mjs

MediumDynamic Requirebin/shogo.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

bin/shogo.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// SPDX-License-Identifier: MIT

4//

5// `shogo` CLI entry shim. Picks an execution mode in this order:

6//

7// 1. Compiled per-platform binary at $PREFIX/dist/shogo (in the

8// tarball release — Bun bundled, no runtime deps).

9// 2. Bundled JS at ../dist/cli.mjs (npm install

10// with no Bun on PATH — Node ESM-loadable).

11// 3. Source TS at ../src/cli.ts (monorepo

12// / `bun link`ed dev, requires Bun or tsx).

13import { fileURLToPath } from 'node:url';

14import { existsSync } from 'node:fs';

15import { dirname, join } from 'node:path';

16import { spawn } from 'node:child_process';

High

Child Process

Package source references child process execution.

bin/shogo.mjsView on unpkg · L15

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const args = process.argv.slice(2);

21const compiledBin = join(__dirname, '..', 'dist', process.platform === 'win32' ? 'shogo.exe' : 'shogo');

22const distEntry = join(__dirname, '..', 'dist', 'cli.mjs');

23const srcEntry = join(__dirname, '..', 'src', 'cli.ts');

25if (existsSync(compiledBin)) {

26 const child = spawn(compiledBin, args, { stdio: 'inherit' });

27 child.on('exit', (code) => process.exit(code ?? 0));

28} else if (existsSync(distEntry)) {

29 await import(distEntry);

30} else if (existsSync(srcEntry)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/shogo.mjsView on unpkg · L28

31 const runner = process.versions.bun ? 'bun' : 'tsx';

32 const child = spawn(runner, [srcEntry, ...args], { stdio: 'inherit' });

33 child.on('exit', (code) => process.exit(code ?? 0));

34} else {

35 console.error('shogo: no executable entry found (looked for dist/shogo, dist/cli.mjs, src/cli.ts)');

36 console.error(' Reinstall with `npm i -g @shogo-ai/worker` or rebuild via `bun run build`.');

37 process.exit(1);

38}

dist/cli.mjsView file

Lines 1-21javascript

1import{createRequire as w$}from"node:module";var z$=Object.defineProperty;var K$=($)=>$;function J$($,X){this[$]=K$.bind(null,X)}var V$