@testsmith/api-spector-agent@0.7.2
API Spector private runner: monitor internal/local APIs the cloud cannot reach, with no inbound connections.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection identifies an active remote-script execution path with an escapable VM sandbox. Warn for the code execution vulnerability; the inspected source does not establish malicious intent warranting a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the configured agent when its monitor feed supplies a crafted request script.
Impact
A compromised monitor source could execute code with the runner's privileges and access its files or credentials.
Mechanism
A script can access a supplied host function's constructor and execute JavaScript in the host context; the VM timeout does not prevent this escape.
AI rationale
Static inspection identifies an active remote-script execution path with an escapable VM sandbox. Warn for the code execution vulnerability; the inspected source does not establish malicious intent warranting a publication block.
Evidence
dist/index.cjs
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The active runner fetches monitor definitions from APP_URL and executes their requests.
- Monitor request scripts are passed to runScript.
- The script sandbox exposes host-created functions, including btoa and atob.
- Scripts execute through node:vm with those host functions accessible, permitting constructor-based escape into the host JavaScript context.
Evidence against
- The manifest contains no lifecycle hooks or runtime self-dependency.
- The runner requires an explicitly configured service URL and authentication token.
- No malicious payload or covert recipient was identified.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/index.cjsView file
247}, m76.utcOffset = function() {
L248: return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
L249: }, m76.diff = function(r53, d75, l76) {
...
L356: * @see DOMParser.SupportedType.isHTML
L357: * @see https://www.iana.org/assignments/media-types/text/html IANA MimeType registration
L358: * @see https://en.wikipedia.org/wiki/HTML Wikipedia
...
L578: /**
L579: * @private
L580: * @param {function (Node):boolean} predicate
...
L915: function _xmlEncoder(c70) {
L916: return c70 == "<" && "<" || c70 == ">" && ">" || c70 == "&" && "&" || c70 == '"' && """ || "&#" + c70.charCodeAt() + ";";
L917: }
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/index.cjsView on unpkg · L247•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/index.cjsView on unpkg247}, m76.utcOffset = function() {
L248: return 15 * -Math.round(this.$d.getTimezoneOffset() / 15);
L249: }, m76.diff = function(r53, d75, l76) {
...
L356: * @see DOMParser.SupportedType.isHTML
L357: * @see https://www.iana.org/assignments/media-types/text/html IANA MimeType registration
L358: * @see https://en.wikipedia.org/wiki/HTML Wikipedia
...
L578: /**
L579: * @private
L580: * @param {function (Node):boolean} predicate
...
L915: function _xmlEncoder(c70) {
L916: return c70 == "<" && "<" || c70 == ">" && ">" || c70 == "&" && "&" || c70 == '"' && """ || "&#" + c70.charCodeAt() + ";";
L917: }
Findings
2 High7 Medium3 Low
HighObfuscated Payload Loaderdist/index.cjs
HighSemantic Analysis Limiteddist/index.cjs
MediumUnsafe Vm Contextdist/index.cjs
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.cjs
MediumOversized Cli Entrypointdist/index.cjs
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @testsmith/api-spector-agent@0.7.2.
See all versions of @testsmith/api-spector-agent for other recorded verdicts.
- Review the evidence and your use of @testsmith/api-spector-agent@0.7.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.