@testsmith/api-spector-agent@0.5.2
API Spector private runner: monitor internal/local APIs the cloud cannot reach, with no inbound connections.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a user-invoked remote monitoring agent with real internal-network and response-data access. Its behavior is package-aligned and requires explicit endpoint and token configuration, so it warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the api-spector-agent CLI with APP_URL and an agent or runtime token.
Impact
A compromised or untrusted configured service could direct requests to reachable internal APIs and receive their headers and bodies.
Mechanism
Poll remote monitor jobs, run constrained request scripts, and upload API results.
AI rationale
This is a user-invoked remote monitoring agent with real internal-network and response-data access. Its behavior is package-aligned and requires explicit endpoint and token configuration, so it warrants a warning rather than a block.
Evidence
dist/index.cjs
Network endpoints2
${APP_URL}/api/monitor-runtime/due${APP_URL}/api/monitor-runtime/${m75.id}/result
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The invoked runner polls a configured cloud endpoint for monitor objects and executes each one.
- Monitor-supplied pre-request scripts run in a VM context.
- The runner returns request and response headers and bodies, capped at 16 KB each, to the configured cloud endpoint.
Evidence against
- package.json has no preinstall, install, postinstall, or other lifecycle script.
- The network base URL and authentication token must be explicitly supplied through environment variables.
- The bundle exposes a user-invoked CLI runner; no import-time installation or persistence behavior was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
9 flaggeddist/index.cjsView file
29561function install() {
L29562: globalThis.fetch = module2.exports.fetch;
L29563: globalThis.Headers = module2.exports.Headers;
...
L29565: globalThis.Request = module2.exports.Request;
L29566: globalThis.FormData = module2.exports.FormData;
L29567: globalThis.WebSocket = module2.exports.WebSocket;
L29568: globalThis.CloseEvent = module2.exports.CloseEvent;
Critical
Builtin Api Tampering Exfiltration
Source mutates builtin networking, serialization, module-loading, or filesystem APIs while forwarding data to an external endpoint.
dist/index.cjsView on unpkg · L29561247}, m76.utcOffset = function() {
L248: return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
L249: }, m76.diff = function(r53, d75, l76) {
...
L356: * @see DOMParser.SupportedType.isHTML
L357: * @see https://www.iana.org/assignments/media-types/text/html IANA MimeType registration
L358: * @see https://en.wikipedia.org/wiki/HTML Wikipedia
...
L578: /**
L579: * @private
L580: * @param {function (Node):boolean} predicate
...
L915: function _xmlEncoder(c70) {
L916: return c70 == "<" && "<" || c70 == ">" && ">" || c70 == "&" && "&" || c70 == '"' && """ || "&#" + c70.charCodeAt() + ";";
L917: }
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
dist/index.cjsView on unpkg · L247Findings
3 Critical3 High6 Medium3 Low
CriticalBuiltin Api Tampering Exfiltrationdist/index.cjs
CriticalRemote Asset Decode Executedist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/index.cjs
HighObfuscated Payload Loaderdist/index.cjs
HighSemantic Analysis Limiteddist/index.cjs
MediumUnsafe Vm Contextdist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
LowFilesystem
Affected versions and remediation
This report applies to @testsmith/api-spector-agent@0.5.2.
See all versions of @testsmith/api-spector-agent for other recorded verdicts.
- Review the evidence and your use of @testsmith/api-spector-agent@0.5.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.