registry  /  @tencent-ai/agent-sdk  /  0.3.197

@tencent-ai/agent-sdk@0.3.197

CodeBuddy Code SDK for JavaScript/TypeScript

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 32 file(s), 2.65 MB of source, external domains: api.qrserver.com, bit.ly, cdn.jsdelivr.net, example.trycloudflare.com, github.com, json-schema.org, reactjs.org, www.w3.org
Oversized source lightweight scan
cli/dist/codebuddy-headless.js15.5 MB file, sampled 256 KB
EnvironmentVarsObfuscatedMinified

Source & flagged code

7 flagged · loading source
cli/dist/web-ui/assets/index-B_atw6xs.jsView file
896patternName = generic_password severity = medium line = 896 matchedText = daemon-s...}));
Medium
Secret Pattern

Package contains a possible secret pattern.

cli/dist/web-ui/assets/index-B_atw6xs.jsView on unpkg · L896
7`);s=c.pop()||"";for(const d of c){const u=d.split(` L8: `);let p="";for(const m of u)m.startsWith("data: ")&&(p+=m.substring(6));if(p)try{const m=JSON.parse(p);this.handleMessage(m)}catch{}}}}finally{n.releaseLock()}}handleMessage(t){if... L9: * @license lucide-react v1.7.0 - ISC
Medium
Dynamic Require

Package source references dynamic require/import behavior.

cli/dist/web-ui/assets/index-B_atw6xs.jsView on unpkg · L7
cli/vendor/genie-trash/linux-arm64View file
•path = cli/vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

cli/vendor/genie-trash/linux-arm64View on unpkg
cli/dist/wasm/tree-sitter.wasmView file
•path = cli/dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

cli/dist/wasm/tree-sitter.wasmView on unpkg
cli/vendor/shim/sitecustomize.pyView file
•path = cli/vendor/shim/sitecustomize.py kind = build_helper sizeBytes = 25078 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/vendor/shim/sitecustomize.pyView on unpkg
cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file
•path = cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg
cli/dist/codebuddy-headless.jsView file
•path = cli/dist/codebuddy-headless.js kind = oversized_source_file sizeBytes = 16263957 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/codebuddy-headless.jsView on unpkg

Findings

3 High8 Medium3 Low
HighObfuscated
HighShips High Entropy Blobcli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2
HighOversized Source Filecli/dist/codebuddy-headless.js
MediumSecret Patterncli/dist/web-ui/assets/index-B_atw6xs.js
MediumDynamic Requirecli/dist/web-ui/assets/index-B_atw6xs.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarycli/vendor/genie-trash/linux-arm64
MediumShips Wasm Modulecli/dist/wasm/tree-sitter.wasm
MediumShips Build Helpercli/vendor/shim/sitecustomize.py
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings