registry / @talkersoft-com/agent-arcade / 0.2.19

@talkersoft-com/agent-arcade@0.2.19

Agent Arcade — voice-driven control for your AI agents (Electron UI + Go API bridge over NDJSON).

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 1.99 MB of source, external domains: github.com, reactjs.org, wezterm.org, www.w3.org

Source & flagged code

7 flagged

package.jsonView file

Lines 16-56json

16 "preload.js",

17 "renderer/**",

18 "arcade/**",

19 "launcher/**",

20 "assets/**",

21 "wezterm/**",

22 "scripts/**",

23 "build/**",

24 "bin/**",

25 "go/bin/**",

26 "wezterm-bridge/bin/**",

27 "vendor/wezterm/**",

28 "studio/dist/**",

29 "arcade/dist/**"

30 ],

31 "main": "main.js",

32 "bin": {

33 "agent-arcade": "bin/agent-arcade.js"

34 },

35 "scripts": {

36 "postinstall": "node scripts/fix-node-pty.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 "build:js": "node scripts/build-js.mjs",

38 "build:go": "cd go && go mod tidy && CGO_ENABLED=1 go build -ldflags=-linkmode=external -o bin/dictation-go . && codesign -f -s - bin/dictation-go",

39 "build:wezterm": "cd wezterm-bridge && CGO_ENABLED=1 go build -ldflags=-linkmode=external -o bin/wezterm-bridge . && codesign -f -s - bin/wezterm-bridge",

40 "vendor:wezterm": "bash scripts/fetch-wezterm.sh",

41 "build": "npm run build:js && npm run vendor:wezterm && npm run build:go && npm run build:wezterm",

42 "icon": "bash build/make_icon.sh",

43 "test": "electron test/popout-diag.js",

44 "kill:prod": "node scripts/relaunch.js prod",

45 "kill:dev": "node scripts/relaunch.js dev",

46 "start": "npm run kill:prod && npm run build && env -u DICTATE_DEV electron . --launcher",

47 "start:nobuild": "npm run kill:prod && env -u DICTATE_DEV electron . --launcher",

48 "prod": "npm run kill:prod && npm run build && env -u DICTATE_DEV electron . --launcher",

49 "prod:nobuild": "npm run kill:prod && env -u DICTATE_DEV electron . --launcher",

50 "dev": "npm run kill:dev && npm run build && DICTATE_DEV=1 electron . --launcher",

51 "dev:nobuild": "npm run kill:dev && DICTATE_DEV=1 electron . --launcher",

52 "backend": "bash scripts/backend.sh",

53 "arcade": "npm run build && electron . --arcade",

54 "arcade:nobuild": "electron . --arcade"

55 },

56 "license": "MIT",

launcher/main.jsView file

Lines 1-31javascript

1// Agent Arcade Launcher — the resident menu-bar (status item) process.

2//

3// A tiny, always-on background agent (Docker-style): no Dock icon, no window, no

4// Go bridge — just the Saturn icon in the macOS menu bar with a menu to launch the

5// Studio (config app) or jump straight into the Arcade. It registers itself to

6// open at login so it returns on every boot. Single-instance: only ever one icon.

7//

8// This is NOT a separate executable — it's the same one-bundle app run in launcher

9// mode (selected by the `--launcher` flag / DICTATE_LAUNCHER env; see main.js).

studio/dist/studio.jsView file

7var __hasOwnProp = Object.prototype.hasOwnProperty; L8: var __commonJS = (cb, mod) => function __require() { L9: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

studio/dist/studio.jsView on unpkg · L7

main.jsView file

Lines 618-658javascript

618 }

619 } catch {}

620 return false;

621}

622function saveAgents(agents) {

623 const doc =

go/bin/dictation-goView file

•path = go/bin/dictation-go kind = native_binary sizeBytes = 5098672 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

go/bin/dictation-goView on unpkg

scripts/fetch-wezterm.shView file

•path = scripts/fetch-wezterm.sh kind = build_helper sizeBytes = 3669 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/fetch-wezterm.shView on unpkg

build/icon.icnsView file

•path = build/icon.icns kind = high_entropy_blob sizeBytes = 796977 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/icon.icnsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code