registry / @tonyclaw/agent-inspector / 3.0.46

@tonyclaw/agent-inspector@3.0.46

Agent observability and knowledge capture layer for AI coding tools.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 331 file(s), 2.37 MB of source, external domains: 127.0.0.1, api-docs.deepseek.com, api.anthropic.com, api.deepseek.com, api.example.com, api.groq.com, api.minimaxi.com, api.openai.com, api.together.xyz, dashscope.aliyuncs.com, docs.bigmodel.cn, example.com, huggingface.co, mimo.xiaomi.com, nodejs.org, open.bigmodel.cn, opencode.ai, openrouter.ai, platform.minimaxi.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 72-112json

72 "build": "bun clean:output && bun build:backend && bun build:ui && bun smoke:ui-preview && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle && bun check:boundaries",

73 "build:backend": "vite build --config vite.backend.config.ts",

74 "build:ui": "vite build --config vite.ui.config.ts",

75 "build:workers": "npx esbuild src/proxy/logFinalizer.worker.ts src/proxy/sessionWorkerEntry.ts --bundle --platform=node --target=node22 --format=esm --outdir=.output/workers --external:better-sqlite3",

76 "smoke:workers": "node scripts/smoke-production-workers.mjs",

77 "smoke:packed-workers": "node scripts/smoke-packed-workers.mjs",

78 "smoke:instances": "node scripts/smoke-windows-instances.mjs",

79 "smoke:coding-agent-instances": "node scripts/smoke-coding-agent-instances.mjs",

80 "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",

81 "check:bundle": "node scripts/check-client-bundle.mjs",

82 "check:boundaries": "node scripts/check-runtime-boundaries.mjs",

83 "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",

84 "compatibility:compare": "node scripts/compatibility/cli.mjs compare",

85 "compatibility:drift": "node scripts/check-backend-compatibility.mjs",

86 "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",

87 "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",

88 "compatibility:run": "node scripts/compatibility/cli.mjs run",

89 "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",

90 "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",

91 "themes:generate": "node scripts/generate-theme-scales.mjs",

92 "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 "prepublishOnly": "npm run build",

94 "typecheck": "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",

95 "lint": "eslint . --cache --cache-location .cache/eslintcache",

96 "format": "biome format --write .",

97 "format:check": "biome format .",

98 "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",

99 "extension:zip": "node scripts/pack-chrome-extension.mjs",

100 "extension:release": "node scripts/release-chrome-extension.mjs",

101 "release": "node scripts/release.mjs",

102 "knip": "knip",

103 "check": "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd",

104 "prepare": "husky",

105 "ladle": "ladle serve",

106 "ladle:build": "ladle build"

107 },

108 "dependencies": {

109 "@mariozechner/pi-agent-core": "^0.73.1",

110 "@mariozechner/pi-ai": "^0.73.1",

111 "@modelcontextprotocol/server": "^2.0.0-beta.4",

112 "@tailwindcss/typography": "^0.5.20",

scripts/setup-windows-runtime.mjsView file

Lines 1-26javascript

1import { copyFile, mkdir, readFile } from "node:fs/promises";

2import { existsSync } from "node:fs";

3import { createRequire } from "node:module";

4import { dirname, join } from "node:path";

5import { fileURLToPath } from "node:url";

src/proxy/alerts.tsView file

Lines 32-72typescript

32export type ListAlertsOptions = AlertFilters & {

33 limit?: number;

34 scanLimit?: number;

35};

37type AlertObservation = {

.output/ui/assets/agent-inspector-58K1_MsC.icoView file

•path = .output/ui/assets/agent-inspector-58K1_MsC.ico kind = high_entropy_blob sizeBytes = 14586 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.output/ui/assets/agent-inspector-58K1_MsC.icoView on unpkg

src/cli.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tonyclaw/agent-inspector@3.0.33 matchedIdentity = npm:[redacted]:3.0.33 similarity = 0.533 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup-windows-runtime.mjsView file

6L7: const require = createRequire(import.meta.url); L8: const scriptDir = dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/setup-windows-runtime.mjsView on unpkg · L6

src/proxy/alerts.tsView file

52evidence: AlertEvidenceLink[]; L53: metadata: Record<string, JsonValue>; L54: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/proxy/alerts.tsView on unpkg · L52

.output/ui/assets/agent-inspector-58K1_MsC.icoView file

•path = .output/ui/assets/agent-inspector-58K1_MsC.ico kind = high_entropy_blob sizeBytes = 14586 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.output/ui/assets/agent-inspector-58K1_MsC.icoView on unpkg

src/cli.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.tsView on unpkg

Findings

3 High5 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blob.output/ui/assets/agent-inspector-58K1_MsC.ico

HighPrevious Version Dangerous Deltasrc/cli.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/setup-windows-runtime.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/proxy/alerts.ts

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings