registry / @tencent-ai/agent-sdk / 0.3.209

@tencent-ai/agent-sdk@0.3.209

CodeBuddy Code SDK for JavaScript/TypeScript

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 1.06 MB of source, external domains: api.qrserver.com, bit.ly, github.com, reactjs.org, www.w3.org

Oversized source lightweight scan

cli/dist/codebuddy-headless.js15.8 MB file, sampled 256 KB

EnvironmentVarsObfuscatedMinified

cli/dist/web-ui/assets/index-GcU4pZms.js2.18 MB file, sampled 256 KB

NetworkObfuscatedHighEntropyStringsUrlStringsapi.qrserver.comwww.w3.org

Source & flagged code

9 flagged

cli/vendor/shim/node-safe-delete-shim.cjsView file

Lines 1-32javascript

1/**

2 * CodeBuddy Node safe-delete shim

3 *

4 * Loaded by node-language-shim.cjs. Installs only delete-protection hooks.

5 */

7'use strict';

9const fs = require('fs');

10const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/vendor/shim/node-safe-delete-shim.cjsView on unpkg · L8

11const os = require('os');

12const url = require('url');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

cli/vendor/shim/node-safe-delete-shim.cjsView on unpkg · L12

15const SESSION_ID = process.env.CODEBUDDY_SESSION_ID

16 || process.env.CLAUDE_SESSION_ID;

18if (!SESSION_ID) {

19 return;

20}

22const SAFE_DELETE_ENABLED = process.env.CODEBUDDY_SAFE_DELETE_ENABLED !== '0';

24if (!SAFE_DELETE_ENABLED) {

25 return;

26}

28if (global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__) {

29 return;

30}

31global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__ = true;

cli/vendor/shim/broker-ipc-client.cjsView file

Lines 1-29javascript

1/**

2 * Neutral broker IPC client for vendor shims.

3 *

4 * Owns JSON-line socket transport only. Runtime-specific request semantics and

5 * response classification stay in the caller.

6 */

8'use strict';

10const net = require('net');

cli/vendor/genie-trash/linux-arm64View file

•path = cli/vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cli/vendor/genie-trash/linux-arm64View on unpkg

cli/dist/wasm/tree-sitter.wasmView file

•path = cli/dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

cli/dist/wasm/tree-sitter.wasmView on unpkg

cli/vendor/shim/native/binding.gypView file

•path = cli/vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/vendor/shim/native/binding.gypView on unpkg

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file

•path = cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg

cli/dist/web-ui/assets/index-GcU4pZms.jsView file

•path = cli/dist/web-ui/assets/index-GcU4pZms.js kind = oversized_source_file sizeBytes = 2284835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/web-ui/assets/index-GcU4pZms.jsView on unpkg

Source & flagged code

9 flagged · loading source

cli/vendor/shim/node-safe-delete-shim.cjsView file

12const url = require('url'); L13: const { execFileSync } = require('child_process'); L14:

High

Child Process

Package source references child process execution.

cli/vendor/shim/node-safe-delete-shim.cjsView on unpkg · L12

8L9: const fs = require('fs'); L10: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/vendor/shim/node-safe-delete-shim.cjsView on unpkg · L8

cli/vendor/shim/broker-ipc-client.cjsView file

9L10: const net = require('net'); L11: const { spawnSync } = require('child_process'); L12: ... L15: function brokerTimeoutMs() { L16: const parsed = Number.parseInt(process.env.CODEBUDDY_SANDBOX_BROKER_TIMEOUT_MS || '', 10); L17: return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/vendor/shim/broker-ipc-client.cjsView on unpkg · L9

•matchType = previous_version_dangerous_delta matchedPackage = @tencent-ai/agent-sdk@0.3.202 matchedIdentity = npm:QHRlbmNlbnQtYWkvYWdlbnQtc2Rr:0.3.202 similarity = 0.935 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/vendor/shim/broker-ipc-client.cjsView on unpkg

cli/vendor/genie-trash/linux-arm64View file

•path = cli/vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cli/vendor/genie-trash/linux-arm64View on unpkg

cli/dist/wasm/tree-sitter.wasmView file

•path = cli/dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

cli/dist/wasm/tree-sitter.wasmView on unpkg

cli/vendor/shim/native/binding.gypView file

•path = cli/vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/vendor/shim/native/binding.gypView on unpkg

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file

•path = cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg

cli/dist/web-ui/assets/index-GcU4pZms.jsView file

•path = cli/dist/web-ui/assets/index-GcU4pZms.js kind = oversized_source_file sizeBytes = 2284835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/web-ui/assets/index-GcU4pZms.jsView on unpkg

Findings

6 High7 Medium3 Low

HighChild Processcli/vendor/shim/node-safe-delete-shim.cjs

HighSame File Env Network Executioncli/vendor/shim/broker-ipc-client.cjs

HighObfuscated

HighShips High Entropy Blobcli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2

HighOversized Source Filecli/dist/web-ui/assets/index-GcU4pZms.js

HighPrevious Version Dangerous Deltacli/vendor/shim/broker-ipc-client.cjs

MediumDynamic Requirecli/vendor/shim/node-safe-delete-shim.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarycli/vendor/genie-trash/linux-arm64

MediumShips Wasm Modulecli/dist/wasm/tree-sitter.wasm

MediumShips Build Helpercli/vendor/shim/native/binding.gyp

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

cli/vendor/shim/node-safe-delete-shim.cjsView file

Lines 1-32javascript

1/**

2 * CodeBuddy Node safe-delete shim

3 *

4 * Loaded by node-language-shim.cjs. Installs only delete-protection hooks.

5 */

7'use strict';

9const fs = require('fs');

10const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/vendor/shim/node-safe-delete-shim.cjsView on unpkg · L8

11const os = require('os');

12const url = require('url');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

cli/vendor/shim/node-safe-delete-shim.cjsView on unpkg · L12

15const SESSION_ID = process.env.CODEBUDDY_SESSION_ID

16 || process.env.CLAUDE_SESSION_ID;

18if (!SESSION_ID) {

19 return;

20}

22const SAFE_DELETE_ENABLED = process.env.CODEBUDDY_SAFE_DELETE_ENABLED !== '0';

24if (!SAFE_DELETE_ENABLED) {

25 return;

26}

28if (global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__) {

29 return;

30}

31global.__CODEBUDDY_NODE_SAFE_DELETE_SHIM_LOADED__ = true;

cli/vendor/shim/broker-ipc-client.cjsView file

Lines 1-29javascript

1/**

2 * Neutral broker IPC client for vendor shims.

3 *

4 * Owns JSON-line socket transport only. Runtime-specific request semantics and

5 * response classification stay in the caller.

6 */

8'use strict';

10const net = require('net');

cli/vendor/genie-trash/linux-arm64View file

•path = cli/vendor/genie-trash/linux-arm64 kind = native_binary sizeBytes = 1052784 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

cli/vendor/genie-trash/linux-arm64View on unpkg

cli/dist/wasm/tree-sitter.wasmView file

•path = cli/dist/wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

cli/dist/wasm/tree-sitter.wasmView on unpkg

cli/vendor/shim/native/binding.gypView file

•path = cli/vendor/shim/native/binding.gyp kind = build_helper sizeBytes = 253 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/vendor/shim/native/binding.gypView on unpkg

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View file

•path = cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2 kind = high_entropy_blob sizeBytes = 24412 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/dist/web-ui/assets/mfixx-CpAhKOZz.woff2View on unpkg

cli/dist/web-ui/assets/index-GcU4pZms.jsView file

•path = cli/dist/web-ui/assets/index-GcU4pZms.js kind = oversized_source_file sizeBytes = 2284835 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/dist/web-ui/assets/index-GcU4pZms.jsView on unpkg