registry  /  @synapsor/runner  /  0.1.4

@synapsor/runner@0.1.4

Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 6 file(s), 720 KB of source, external domains: 127.0.0.1

Source & flagged code

6 flagged · loading source
dist/runner.mjsView file
4import fs3 from "node:fs/promises"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import crypto5 from "node:crypto";
High
Child Process

Package source references child process execution.

dist/runner.mjsView on unpkg · L4
4Detached bundled service listener: dist/runner.mjs launches a Node helper and exposes a broad-bound HTTP listener. L4: import fs3 from "node:fs/promises"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import crypto5 from "node:crypto"; L7: import net from "node:net"; L8: import os from "node:os"; ... L322: }; L323: const response = await this.post("/v1/writeback/jobs/claim", body); L324: const jobs = Array.isArray(response.jobs) ? response.jobs : []; ... L382: }); L383: const payload = await response.json().catch(() => ({})); L384: if (response.ok && payload?.ok) { ... L2566: }
High
Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/runner.mjsView on unpkg · L4
10166async function dynamicImportModule(specifier) { L10167: const importer = new Function("specifier", "return import(specifier)"); L10168: return importer(specifier);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/runner.mjsView on unpkg · L10166
10166async function dynamicImportModule(specifier) { L10167: const importer = new Function("specifier", "return import(specifier)"); L10168: return importer(specifier);
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/runner.mjsView on unpkg · L10166
dist/cli.jsView file
1Cross-file remote execution chain: dist/cli.js spawns dist/runner.mjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import { spawnSync } from 'node:child_process'; L3: import { dirname, basename, join } from 'node:path'; ... L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const invoked = basename(process.argv[1] || 'synapsor'); ... L15: stdio: 'inherit', L16: env: { ...process.env, NODE_NO_WARNINGS: '1', SYNAPSOR_RUNNER_COMMAND_NAME: commandName }, L17: });
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L1
examples/openai-agents-http/MakefileView file
•path = examples/openai-agents-http/Makefile kind = build_helper sizeBytes = 212 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/openai-agents-http/MakefileView on unpkg

Findings

4 High5 Medium5 Low
HighChild Processdist/runner.mjs
HighShell
HighCross File Remote Execution Contextdist/cli.js
HighSpawned Bundled Service Listenerdist/runner.mjs
MediumDynamic Requiredist/runner.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperexamples/openai-agents-http/Makefile
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/runner.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings