registry / @tangle-network/sandbox / 0.9.7

@tangle-network/sandbox@0.9.7

⚠ Under review

Client SDK for the Tangle Sandbox platform - build AI agent applications with dev containers

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 442 KB of source, external domains: bootstrap.pypa.io, intelligence.tangle.tools, micro.mamba.pm, router.tangle.tools, rpc.tangle.tools

Source & flagged code

3 flagged

dist/client-BZSkXIEp.jsView file

Lines 108-148javascript

108 if (crypto?.randomUUID) return `fleet_${crypto.randomUUID().replaceAll("-", "").slice(0, 24)}`;

109 if (crypto?.getRandomValues) {

110 const bytes = crypto.getRandomValues(new Uint8Array(12));

111 return `fleet_${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;

112 }

113 throw new ValidationError("Fleet id generation requires global crypto");

114}

115function assertSafeId(value, label) {

116 if (value.length === 0 || value.length > MAX_MACHINE_ID_LENGTH || !machineIdPattern.test(value)) throw new ValidationError(`${label} must be 1-${MAX_MACHINE_ID_LENGTH} characters and contain only letters, numbers, '.', '_' or '-'`, { [label]: "invalid" });

117}

118function assertUniqueMachineIds(machines) {

119 const seen = /* @__PURE__ */ new Set();

120 for (const machine of machines) {

121 assertSafeId(machine.machineId, "machineId");

122 if (seen.has(machine.machineId)) throw new ValidationError(`Duplicate machineId '${machine.machineId}' in fleet create request`, { machineId: "duplicate" });

123 seen.add(machine.machineId);

124 }

125}

126function assertNoReservedMetadata(metadata, label) {

127 if (!metadata) return;

128 const reserved = Object.keys(metadata).find((key) => key.startsWith(RESERVED_METADATA_PREFIX));

129 if (reserved) throw new ValidationError(`${label} metadata key '${reserved}' is reserved by Tangle`, { metadata: "reserved" });

130}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/client-BZSkXIEp.jsView on unpkg · L128

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/client-BZSkXIEp.jsView on unpkg · L128

131function mergeCreateOptions(defaults, machine) {

132 const { machineId: _machineId, metadata: _metadata, name: _name, role: _role, ...rest } = machine;

133 const backend = defaults?.backend || machine.backend ? {

134 ...defaults?.backend,

135 ...machine.backend,

136 type: machine.backend?.type ?? defaults?.backend?.type ?? "opencode",

137 model: {

138 ...defaults?.backend?.model,

139 ...machine.backend?.model

140 }

141 } : void 0;

142 const driver = machine.driver ?? defaults?.driver;

143 return {

144 ...defaults,

145 ...rest,

146 resources: normalizeSandboxResources({

147 ...defaults?.resources,

148 ...machine.resources

Lines 971-1011javascript

971function withRequestContextHeaders(response, path, method) {

972 const headers = new Headers(response.headers);

973 headers.set("x-tangle-request-path", path);

974 if (method) headers.set("x-tangle-request-method", method);

975 return new

Source & flagged code

3 flagged · loading source

dist/client-BZSkXIEp.jsView file

128const reserved = Object.keys(metadata).find((key) => key.startsWith(RESERVED_METADATA_PREFIX)); L129: if (reserved) throw new ValidationError(`${label} metadata key '${reserved}' is reserved by Tangle`, { metadata: "reserved" }); L130: } ... L309: } L310: async exec(machineId, command, options) { L311: const [result] = await this.dispatchExec(command, { ... L322: async dispatchExecDetailed(command, options) { L323: const response = await this.client.fetch(`/v1/fleets/${this.fleetId}/dispatch`, { L324: method: "POST", ... L327: if (!response.ok) { L328: const body = await response.text(); L329: throw parseErrorResponse(response.status, body, void 0, response.headers);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/client-BZSkXIEp.jsView on unpkg · L128

128Trigger-reachable chain: manifest.main -> dist/index.js -> dist/client-BZSkXIEp.js L128: const reserved = Object.keys(metadata).find((key) => key.startsWith(RESERVED_METADATA_PREFIX)); L129: if (reserved) throw new ValidationError(`${label} metadata key '${reserved}' is reserved by Tangle`, { metadata: "reserved" }); L130: } ... L309: } L310: async exec(machineId, command, options) { L311: const [result] = await this.dispatchExec(command, { ... L322: async dispatchExecDetailed(command, options) { L323: const response = await this.client.fetch(`/v1/fleets/${this.fleetId}/dispatch`, { L324: method: "POST", ... L327: if (!response.ok) { L328: const body = await response.text(); L329: throw parseErrorResponse(response.status, body, void 0, response.headers);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/client-BZSkXIEp.jsView on unpkg · L128

991const [{ existsSync, readFileSync }, { homedir }, { join }] = await Promise.all([ L992: import("node:fs"), L993: import("node:os"),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client-BZSkXIEp.jsView on unpkg · L991

Findings

2 Critical3 Medium4 Low

CriticalCredential Exfiltrationdist/client-BZSkXIEp.js

CriticalTrigger Reachable Dangerous Capabilitydist/client-BZSkXIEp.js

MediumDynamic Requiredist/client-BZSkXIEp.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/client-BZSkXIEp.jsView file

Lines 108-148javascript

108 if (crypto?.randomUUID) return `fleet_${crypto.randomUUID().replaceAll("-", "").slice(0, 24)}`;

109 if (crypto?.getRandomValues) {

110 const bytes = crypto.getRandomValues(new Uint8Array(12));

111 return `fleet_${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;

112 }

113 throw new ValidationError("Fleet id generation requires global crypto");

114}

115function assertSafeId(value, label) {

117}

118function assertUniqueMachineIds(machines) {

119 const seen = /* @__PURE__ */ new Set();

120 for (const machine of machines) {

121 assertSafeId(machine.machineId, "machineId");

122 if (seen.has(machine.machineId)) throw new ValidationError(`Duplicate machineId '${machine.machineId}' in fleet create request`, { machineId: "duplicate" });

123 seen.add(machine.machineId);

124 }

125}

126function assertNoReservedMetadata(metadata, label) {

127 if (!metadata) return;

128 const reserved = Object.keys(metadata).find((key) => key.startsWith(RESERVED_METADATA_PREFIX));

129 if (reserved) throw new ValidationError(`${label} metadata key '${reserved}' is reserved by Tangle`, { metadata: "reserved" });

130}

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/client-BZSkXIEp.jsView on unpkg · L128

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/client-BZSkXIEp.jsView on unpkg · L128

131function mergeCreateOptions(defaults, machine) {

132 const { machineId: _machineId, metadata: _metadata, name: _name, role: _role, ...rest } = machine;

133 const backend = defaults?.backend || machine.backend ? {

134 ...defaults?.backend,

135 ...machine.backend,

136 type: machine.backend?.type ?? defaults?.backend?.type ?? "opencode",

137 model: {

138 ...defaults?.backend?.model,

139 ...machine.backend?.model

140 }

141 } : void 0;

142 const driver = machine.driver ?? defaults?.driver;

143 return {

144 ...defaults,

145 ...rest,

146 resources: normalizeSandboxResources({

147 ...defaults?.resources,

148 ...machine.resources

Lines 971-1011javascript

971function withRequestContextHeaders(response, path, method) {

972 const headers = new Headers(response.headers);

973 headers.set("x-tangle-request-path", path);

974 if (method) headers.set("x-tangle-request-method", method);

975 return new