registry / @team-agent/installer / 0.5.38

@team-agent/installer@0.5.38

npx installer for Team Agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 2 file(s), 28.4 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 8-48json

8 "tmux",

9 "multi-agent"

10 ],

11 "repository": {

12 "type": "git",

13 "url": "git+https://github.com/Florious95/team-agent.git"

14 },

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node npm/bincheck.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

crates/team-agent/src/tmux_backend/tests.rsView file

1097patternName = aws_access_key severity = critical line = 1097 matchedText = key AKIA...E\n\

Critical

Critical Secret

Package contains a critical-looking secret pattern.

crates/team-agent/src/tmux_backend/tests.rsView on unpkg · L1097

1097patternName = aws_access_key severity = critical line = 1097 matchedText = key AKIA...E\n\

Critical

Secret Pattern

AWS access key ID in crates/team-agent/src/tmux_backend/tests.rs

crates/team-agent/src/tmux_backend/tests.rsView on unpkg · L1097

1113patternName = aws_access_key severity = critical line = 1113 matchedText = !out.con...E"),

Critical

Secret Pattern

AWS access key ID in crates/team-agent/src/tmux_backend/tests.rs

crates/team-agent/src/tmux_backend/tests.rsView on unpkg · L1113

npm/install.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs"; ... L9: const modulePath = fileURLToPath(import.meta.url); L10: const __dirname = path.dirname(modulePath); L11: const packageRoot = path.resolve(__dirname, ".."); L12: const require = createRequire(import.meta.url); L13: const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")); L14: const DOCTOR_TIMEOUT_MS = 5000; ... L130: const runtimeRoot = path.resolve(expandHome(opts.runtimeDir || path.join(os.homedir(), ".team-agent", "runtime"))); L131: const installTarget = resolveInstallBinDir({ env: process.env, home: os.homedir(), prefix: opts.prefix }); L132: const binDir = installTarget.binDir;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

npm/install.mjsView on unpkg · L1

Findings

3 Critical1 High3 Medium4 Low

CriticalCritical Secretcrates/team-agent/src/tmux_backend/tests.rs

CriticalSecret Patterncrates/team-agent/src/tmux_backend/tests.rs

HighInstall Time Lifecycle Scriptspackage.json

MediumEnvironment Vars

MediumInstall Persistencenpm/install.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

crates/team-agent/src/tmux_backend/tests.rsView file

Lines 1077-1133rust

1077 !diagnostics.attempts_detail.is_empty(),

1078 "E50: E46 consumption gate must preserve per-capture diagnostics"

1079 );

1080 assert_eq!(diagnostics.attempts_detail[0].attempt_index, 1);

1081 assert!(

1082 diagnostics.attempts_detail[0]

1083 .pane_tail_excerpt

1084 .contains("Pasted content"),

1085 "E50: recorded pane tail should contain the post-submit capture; got {:?}",

1086 diagnostics.attempts_detail[0]

1087 );

1088 }

1089

1090 /// **E50 PR-1 secret scrubbing**: `scrub_pane_excerpt` must strip ANSI

1091 /// + redact common secret shapes so emitted events.jsonl doesn't leak.

1092 #[test]

1093 fn e50_scrub_pane_excerpt_strips_ansi_and_redacts_secret_shapes() {

1094 use super::scrub_pane_excerpt;

1095 let raw = "\x1b[31merror\x1b[0m: sk-abcdef123ghi\n\

1096 token Bearer abc.def.ghi\n\

1097 key AKIAIOSFODNN7EXAMPLE\n\

Critical

Critical Secret

Package contains a critical-looking secret pattern.

crates/team-agent/src/tmux_backend/tests.rsView on unpkg · L1097

Critical

Secret Pattern

AWS access key ID in crates/team-agent/src/tmux_backend/tests.rs

crates/team-agent/src/tmux_backend/tests.rsView on unpkg · L1097

1098 ghp_1234567890abcdef\n\

1099 hex deadbeefdeadbeefdeadbeefdeadbeefcafebabe\n\

1100 plain text below";

1101 let (out, lines) = scrub_pane_excerpt(raw, 20);

1102 assert!(lines >= 5, "E50: at least 5 non-empty lines; got {lines}");

1103 assert!(!out.contains("\x1b"), "E50: ANSI escape stripped; got {out:?}");

1104 assert!(

1105 !out.contains("sk-abcdef123ghi"),

1106 "E50: sk- secret must be redacted; got {out:?}"

1107 );

1108 assert!(

1109 !out.contains("ghp_1234567890abcdef"),

1110 "E50: ghp_ secret must be redacted; got {out:?}"

1111 );

1112 assert!(

1113 !out.contains("AKIAIOSFODNN7EXAMPLE"),

Critical

Secret Pattern

AWS access key ID in crates/team-agent/src/tmux_backend/tests.rs

crates/team-agent/src/tmux_backend/tests.rsView on unpkg · L1113

1114 "E50: AKIA secret must be redacted; got {out:?}"

1115 );

1116 assert!(

1117 !out.contains("abc.def.ghi"),

1118 "E50: Bearer secret token must be redacted; got {out:?}"

1119 );

1120 assert!(

1121 !out.contains("deadbeefdeadbeefdeadbeefdeadbeefcafebabe"),

1122 "E50: 32+ hex run must be redacted; got {out:?}"

1123 );

1124 assert!(

1125 out.contains("REDACTED"),

1126 "E50: redactions visible; got {out:?}"

1127 );

1128 assert!(

1129 out.contains("plain text below"),

1130 "E50: non-secret content preserved; got {out:?}"

1131 );

1132 }

1133

npm/install.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

4import { createRequire } from "node:module";

5import os from "node:os";

6import path from "node:path";

7import { fileURLToPath } from "node:url";

9const modulePath = fileURLToPath(import.meta.url);

10const __dirname = path.dirname(modulePath);

11const packageRoot = path.resolve(__dirname, "..");

12const require = createRequire(import.meta.url);

13const packageJson = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));

14const DOCTOR_TIMEOUT_MS = 5000;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

npm/install.mjsView on unpkg · L1

15const VERSION_SMOKE_TIMEOUT_MS = 5000;

16const INSTALL_MANIFEST = "install-manifest.json";

17const PATH_MARKER = "# team-agent PATH (E48)";

18const WRAPPER_MARKER = "# team-agent installer wrapper";

19const WRAPPER_NAMES = ["team-agent", "team_orchestrator", "team-agent-coordinator"];

21if (isCliEntrypoint()) {