registry / @task-handoff/control-plane / 0.0.2

@task-handoff/control-plane@0.0.2

Prebuilt TaskHandoff control plane runtime.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 4.92 MB of source, external domains: 10.0.0.12, 127.0.0.1, api.openai.com, chevrotain.io, control-plane.example.com, control.example.com, empty.invalid, en.wikipedia.org, github.com, ilinkai.weixin.qq.com, json-schema.org, langium.org, www.w3.org

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-21javascript

1"use strict";var e=require("commander"),t=require("node:fs"),s=require("node:path"),n=require("fastify"),i=require("@fastify/websocket"),a=require("zod"),r=require("node:crypto"),o=require("node:util"),d=require("node:os"),c=require("ws"),l=require("node:http"),p=require("node:net"),u=require("dingtalk-stream"),g=require("telegramify-markdown"),h=require("node:fs/promises");const m=20971520,f=41943040,I="ai-session.snapshot",y="ai-session.patch",b="ai-session.removed",w=a.z.string().trim().min(1).max(80),S=a.z.enum(["running","waiting","idle","failed"]),A=a.z.enum(["thinking","tool","editing", ...

2set -eu

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

4CONTROL_PLANE_URL=""

5JOIN_TOKEN=""

6SERVICE_USER="task-handoff"

7DATA_DIR="/var/lib/task-handoff/node-agent"

8ENV_DIR="/etc/task-handoff"

9HOST="127.0.0.1"

10PORT="8091"

11TASK_HANDOFF_BIN="\${TASK_HANDOFF_BIN:-}"

12PACKAGE_URL="\${TASK_HANDOFF_PACKAGE_URL:-}"

13NPM_PACKAGE="\${TASK_HANDOFF_NPM_PACKAGE:-}"

14CONTROLLED_INSTANCE_PACKAGE="\${TASK_HANDOFF_CONTROLLED_INSTANCE_PACKAGE:-}"

15CONTROLLED_INSTANCE_PACKAGE_URL="\${TASK_HANDOFF_CONTROLLED_INSTANCE_PACKAGE_URL:-}"

16VERSION="\${TASK_HANDOFF_VERSION:-}"

18usage() {

19 cat <<'USAGE'

20Usage: install-node-agent.sh --control-plane <url> --join-token <token> [options]

Long lines were clipped for display.

•matchType = previous_version_dangerous_delta matchedPackage = @task-handoff/control-plane@0.0.1 matchedIdentity = npm:[redacted]:0.0.1 similarity = 0.985 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

ui/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code