registry / @stigmer/runner / 3.1.3

@stigmer/runner@3.1.3

Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 468 file(s), 3.38 MB of source, external domains: api.github.com, api.stigmer.ai, serverlessworkflow.io

Source & flagged code

3 flagged

dist/middleware/otel-spans.jsView file

Lines 21-61javascript

21const METRIC_LLM_TOKENS_OUTPUT = "stigmer.llm.tokens.output";

22const METRIC_MCP_TOOL_CALL_DURATION = "stigmer.mcp.tool_call.duration";

23const METRIC_MCP_TOOL_CALL_COUNT = "stigmer.mcp.tool_call.count";

24const TRACER_NAME = "stigmer-runner";

25const METER_NAME = "stigmer-runner";

26function inferProvider(modelName) {

27 const lower = modelName.toLowerCase();

28 if (lower.startsWith("claude"))

29 return "anthropic";

30 if (lower.startsWith("gpt") || lower.startsWith("o1") || lower.startsWith("o3") || lower.startsWith("o4"))

31 return "openai";

32 if (["qwen", "llama", "deepseek", "codellama", "mistral", "phi"].some(p => lower.startsWith(p)))

33 return "ollama";

34 return "unknown";

35}

36/**

37 * Lazy OTel accessor. Returns null-object implementations when

38 * @opentelemetry/api is not available or no provider is configured.

39 */

40async function getOtel() {

41 try {

42 const api = await import("@opentelemetry/api");

43 return api;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/middleware/otel-spans.jsView on unpkg · L41

44 }

45 catch {

46 return null;

47 }

48}

49export function createOtelSpansMiddleware(config = {}) {

50 const toolServerMap = config.toolServerMap ?? new Map();

51 // Metric instruments are created lazily on first use

52 let metricsInitialized = false;

53 let llmCallDuration = null;

54 let llmCallCount = null;

55 let llmTokensInput = null;

56 let llmTokensOutput = null;

57 let mcpToolDuration = null;

58 let mcpToolCount = null;

59 async function ensureMetrics() {

60 if (metricsInitialized)

61 return;

dist/shared/filereview/git-substrate.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @stigmer/runner@3.1.2 matchedIdentity = npm:QHN0aWdtZXIvcnVubmVy:3.1.2 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/filereview/git-substrate.jsView on unpkg

src/activities/execute-deep-agent/__tests__/status-builder.test.tsView file

Lines 713-753typescript

713 policies: new Map([

714 [`${serverSlug}/${toolName}`, {

715 toolName,

716 mcpServerSlug: serverSlug,

717 requiresApproval: true,

718 approvalMessage: "Approve?",

719 source:

Source & flagged code

3 flagged · loading source

dist/middleware/otel-spans.jsView file

41package = @stigmer/runner; repositoryIdentity = stigmer; dependency = @opentelemetry/api L41: try { L42: const api = await import("@opentelemetry/api"); L43: return api;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/middleware/otel-spans.jsView on unpkg · L41

dist/shared/filereview/git-substrate.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/filereview/git-substrate.jsView on unpkg

src/activities/execute-deep-agent/__tests__/status-builder.test.tsView file

733patternName = generic_password severity = medium line = 733 matchedText = password...et",

Medium

Secret Pattern

Hardcoded password in src/activities/execute-deep-agent/__tests__/status-builder.test.ts

src/activities/execute-deep-agent/__tests__/status-builder.test.tsView on unpkg · L733

Findings

2 High4 Medium4 Low

HighCopied Package Dependency Bridgedist/middleware/otel-spans.js

HighPrevious Version Dangerous Deltadist/shared/filereview/git-substrate.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternsrc/activities/execute-deep-agent/__tests__/status-builder.test.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/middleware/otel-spans.jsView file

Lines 21-61javascript

21const METRIC_LLM_TOKENS_OUTPUT = "stigmer.llm.tokens.output";

22const METRIC_MCP_TOOL_CALL_DURATION = "stigmer.mcp.tool_call.duration";

23const METRIC_MCP_TOOL_CALL_COUNT = "stigmer.mcp.tool_call.count";

24const TRACER_NAME = "stigmer-runner";

25const METER_NAME = "stigmer-runner";

26function inferProvider(modelName) {

27 const lower = modelName.toLowerCase();

28 if (lower.startsWith("claude"))

29 return "anthropic";

30 if (lower.startsWith("gpt") || lower.startsWith("o1") || lower.startsWith("o3") || lower.startsWith("o4"))

31 return "openai";

32 if (["qwen", "llama", "deepseek", "codellama", "mistral", "phi"].some(p => lower.startsWith(p)))

33 return "ollama";

34 return "unknown";

35}

36/**

37 * Lazy OTel accessor. Returns null-object implementations when

38 * @opentelemetry/api is not available or no provider is configured.

39 */

40async function getOtel() {

41 try {

42 const api = await import("@opentelemetry/api");

43 return api;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/middleware/otel-spans.jsView on unpkg · L41

44 }

45 catch {

46 return null;

47 }

48}

49export function createOtelSpansMiddleware(config = {}) {

50 const toolServerMap = config.toolServerMap ?? new Map();

51 // Metric instruments are created lazily on first use

52 let metricsInitialized = false;

53 let llmCallDuration = null;

54 let llmCallCount = null;

55 let llmTokensInput = null;

56 let llmTokensOutput = null;

57 let mcpToolDuration = null;

58 let mcpToolCount = null;

59 async function ensureMetrics() {

60 if (metricsInitialized)

61 return;

dist/shared/filereview/git-substrate.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/shared/filereview/git-substrate.jsView on unpkg

src/activities/execute-deep-agent/__tests__/status-builder.test.tsView file

Lines 713-753typescript

713 policies: new Map([

714 [`${serverSlug}/${toolName}`, {

715 toolName,

716 mcpServerSlug: serverSlug,

717 requiresApproval: true,

718 approvalMessage: "Approve?",

719 source: