@testsmith/api-spector-agent@0.5.1
API Spector private runner: monitor internal/local APIs the cloud cannot reach, with no inbound connections.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes an explicit-user, cloud-controlled monitoring capability that can disclose internal API transaction data, but no package lifecycle hook, stealth persistence, opaque payload loader, or unsolicited endpoint was found. The static high-risk findings largely arise from bundled runtime dependencies and the stated monitoring function.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the CLI with APP_URL and an agent or runtime token.
Impact
The configured service can receive API request and response material, including headers and bodies, from systems reachable by the runner.
Mechanism
Cloud-controlled monitor execution and API-result upload.
AI rationale
The source establishes an explicit-user, cloud-controlled monitoring capability that can disclose internal API transaction data, but no package lifecycle hook, stealth persistence, opaque payload loader, or unsolicited endpoint was found. The static high-risk findings largely arise from bundled runtime dependencies and the stated monitoring function.
Evidence
dist/index.cjs
Network endpoints2
${APP_URL}/api/monitor-runtime/due${APP_URL}/api/monitor-runtime/${m75.id}/result
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI entrypoint starts automatically and repeatedly polls a user-configured cloud URL for monitor definitions.
- Cloud-supplied monitor scripts are executed in a Node VM sandbox.
- The agent returns up to 16 KB of request headers, request bodies, response headers, and response bodies to the configured cloud service.
Evidence against
- package.json contains no install lifecycle scripts.
- Network destination and credentials require explicit APP_URL and token environment variables.
- The child-process code is bundled Electron fallback code and is not reached by the agent entrypoint.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/index.cjsView file
29561function install() {
L29562: globalThis.fetch = module2.exports.fetch;
L29563: globalThis.Headers = module2.exports.Headers;
...
L29565: globalThis.Request = module2.exports.Request;
L29566: globalThis.FormData = module2.exports.FormData;
L29567: globalThis.WebSocket = module2.exports.WebSocket;
L29568: globalThis.CloseEvent = module2.exports.CloseEvent;
Critical
Builtin Api Tampering Exfiltration
Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.
dist/index.cjsView on unpkg · L29561247}, m76.utcOffset = function() {
L248: return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
L249: }, m76.diff = function(r53, d75, l76) {
...
L356: * @see DOMParser.SupportedType.isHTML
L357: * @see https://www.iana.org/assignments/media-types/text/html IANA MimeType registration
L358: * @see https://en.wikipedia.org/wiki/HTML Wikipedia
...
L578: /**
L579: * @private
L580: * @param {function (Node):boolean} predicate
...
L915: function _xmlEncoder(c70) {
L916: return c70 == "<" && "<" || c70 == ">" && ">" || c70 == "&" && "&" || c70 == '"' && """ || "&#" + c70.charCodeAt() + ";";
L917: }
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.cjsView on unpkg · L247Findings
3 Critical3 High6 Medium3 Low
CriticalBuiltin Api Tampering Exfiltrationdist/index.cjs
CriticalRemote Asset Decode Executedist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/index.cjs
HighObfuscated Payload Loaderdist/index.cjs
HighSemantic Analysis Limiteddist/index.cjs
MediumUnsafe Vm Contextdist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowFilesystem
Affected versions and remediation
This report applies to @testsmith/api-spector-agent@0.5.1.
See all versions of @testsmith/api-spector-agent for other recorded verdicts.
- Review the evidence and your use of @testsmith/api-spector-agent@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.