registry / @wagemule/daemon / 0.1.65

@wagemule/daemon@0.1.65

NiuMa local daemon for connecting local agent runtimes to Workspace Server.

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 1 file(s), 850 KB of source, external domains: api.anthropic.com, api.cursor.com, api.moonshot.cn, api.openai.com, registry.npmjs.org, www.apple.com

Source & flagged code

7 flagged

dist/main.cjsView file

7375var import_node_fs5 = require("node:fs"); L7376: var import_node_child_process10 = require("node:child_process"); L7377: var import_node_path25 = __toESM(require("node:path"));

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L7375

13236const impl = this.options.execFileImpl ?? import_node_child_process4.execFile; L13237: const execAsync = (0, import_node_util.promisify)(impl); L13238: const result = await execAsync(command, args, { timeout: timeoutMs, cwd: this.homedir() });

High

Shell

Package source references shell execution.

dist/main.cjsView on unpkg · L13236

7375var import_node_fs5 = require("node:fs"); L7376: var import_node_child_process10 = require("node:child_process"); L7377: var import_node_path25 = __toESM(require("node:path")); L7378: var import_node_http2 = require("node:http"); L7379: ... L7385: cwd: spec.cwd, L7386: env: spec.env ?? process.env, L7387: stdio: ["ignore", "pipe", "pipe"]

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.cjsView on unpkg · L7375

8var __hasOwnProp = Object.prototype.hasOwnProperty; L9: var __commonJS = (cb, mod) => function __require() { L10: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.cjsView on unpkg · L8

2604if (typeof node_buffer.Buffer === "function") { L2605: return node_buffer.Buffer.from(src, "base64"); L2606: } else if (typeof atob === "function") { ... L5217: yield* this.next(token); L5218: yield* this.end(forceDoc, endOffset); L5219: } ... L5221: *next(token) { L5222: if (node_process.env.LOG_STREAM) L5223: console.dir(token, { depth: null }); ... L7375: var import_node_fs5 = require("node:fs"); L7376: var import_node_child_process10 = require("node:child_process"); L7377: var import_node_path25 = __toESM(require("node:path"));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main.cjsView on unpkg · L2604

12026if (!this.inquirerPromise) { L12027: const dynamicImport = new Function( L12028: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/main.cjsView on unpkg · L12026

container/build-runtime-image.shView file

•path = container/build-runtime-image.sh kind = build_helper sizeBytes = 2982 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

container/build-runtime-image.shView on unpkg

Source & flagged code

7 flagged · loading source

dist/main.cjs

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code