registry / @wular/coder / 0.1.24

@wular/coder@0.1.24

Delegating coding-agent runtime

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 374 KB of source, external domains: json-schema.org, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

2var T$=Object.defineProperty;var Q1=($,W)=>{for(var q in W)T$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import W1 from"node:net";import d from"node:path";import x from"node:process";function o($,W={}){let q=new Set(W.valueOptions??[]),Z=new Set(W.booleanOptions??[]),G=W.aliasMap??{},Y={},Q=[],y=!1;for(let X=0;X<$.length;X+=1){let H=$[X];if(y){Q.push(H);continue}if(H==="--"){y=!0;continue}if(!H.startsWith("-")||H==="-"){Q.push(H);continue}if(H.startsWith("--")){let[V,_]=H.slice(2).split("=",2),P=G[V]??V;if(Z.has(P)){Y[P]=_===void 0?!0:_!=="false"; ...

3`,"utf8"),Q}function K$($,W){let q=L.join(R($,W),"job.json");if(!O.existsSync(q))return null;try{return JSON.parse(O.readFileSync(q,"utf8"))}catch{return null}}function A1($,W){let q=R($,W);if(!O.existsSync(q))return!1;return O.rmSync(q,{recursive:!0,force:!0}),!0}function u$($){if(!$)return!1;try{return process.kill($,0),!0}catch(W){return W.code==="EPERM"}}function S$($){try{let W=Z$("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]}).trim(),q=W?Date.parse(W):NaN;return Number.isFinite(q)?q:null}catch{return null}}function I$($,W){if(!u$($))return!1;let q ...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function B1($,W,q=40){let Z=L.join(R($,W),"log.jsonl");if(!O.existsSync(Z))return[];return O.readFileSync(Z,"utf8").split

5`,"utf8")}function l$($){let W=n($);if(M.existsSync(W))M.unlinkSync(W)}async function a$($){if(!$)return!1;try{return await z$($,150)}catch{return!1}}async function X$($,W={}){let q=W.scriptPath??n$(),Z=Q$(),G=c($),Y=G?.version===Z&&G?.scriptPath===q;if(G&&Y&&await a$(G.endpoint))return G;if(G)Y$({endpoint:G.endpoint??null,pidFile:G.pidFile??null,logFile:G.logFile??null,sessionDir:G.sessionDir??null,pid:G.pid??null,killProcess:W.killProcess??null}),l$($);let Q=g$(),X=(W.createBrokerEndpoint??$$)(Q,W.platform),H=E.join(Q,"broker.pid"),N=E.join(Q,"broker.log"),J=p$({scriptPath:q,cwd:$,endpoint:X ...

6${Q.stdout}`.trim();if(!Q.error&&t$(y))return{attempted:!0,delivered:!1,method:"taskkill",result:Q};if(Q.error?.code==="ENOENT")try{return Y(q),{attempted:!0,delivered:!0,method:"kill"}}

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf(`

8`)}}handleLine($){if(!$.trim())return;let W;try{W=JSON.parse($)}catch(q){this.handleExit(a(`Failed to parse codex app-server JSONL: ${q instanceof Error?q.message:String(q)}`,{line:$}));return}if(W.id!==void 0&&W.method){this.handleServerRequest(W);return}if(W.id!==void 0){let q=this.pending.get(W.id);if(!q)return;if(this.pending.delete(W.id),W.error)q.reject(a(W.error.message??`codex app-server ${q.method} failed.`,W.error));else q.resolve(W.result??{});return}if(W.method&&this.notificationHandler)this.notificationHandler(W)}defaultHandleServerRequest($){let W=this.serverRequestHandler;if(!W) ...

9${G}`:""}`);this.handleExit(Y)}),this.readline=o$.createInterface({input:$}),this.readline.on("line",(q)=>{this.handleLine(q)}),await this.request("initialize",{clientInfo:this.options.clientInfo??N$(),capabilities:this.options.capabilities??O$}),this.notify("initialized",{})}async close(){if(this.closed){await

10`,q=this.proc?.stdin;if(!q)throw Error("codex app-server stdin is not available.");q.write(W)}}class L$ extends i{endpoint;socket;constructor($,W={}){super($,W);this.transport="broker",this.endpoint=W.brokerEndpoint}async

11`,q=this.socket;if(!q)throw Error("codex app-server broker connection is not connected.");q.write(W)}}class t{static async connect($,W={}){let q=null;if(!W.disableBroker){if(q=W.brokerEndpoint??W.env?.[H$]??k.env[H$]??null,!q&&W.reuseExistingBroker)q=c($)?.endpoint??null;if(!q&&!W.reuseExistingBroker)q=(await X$($,{env:W.env}))?.endpoint??null}let Z=q?new L$($,{...W,brokerEndpoint:q}):new V$($,W);return await Z.initialize(),Z}}var q1=new Set(["turn/start","review/start","thread/compact/start"]);function J$($,W,q){let Z=new Set;if(W?.threadId)Z.add(W.threadId);if($==="review/start"&&q?.reviewTh ...

12`)}function Z1($){return $?.method==="turn/interrupt"}function G1($){if(!$)return;u.mkdirSync(d.dirname($),{recursive:!0}),u.writeFileSync($,`${x.pid}

13`,"utf8")}async function K1(){let[$,...W]=x.argv.slice(2);if($!=="serve")throw Error("Usage: node src/lib/broker.mjs serve --endpoint <value> [--cwd <path>] [--pid-file <path>]");let{options:q}=o(W,{valueOptions:["cwd","pid-file","endpoint"]});if(!

14`);while(F!==-1){let r=U.slice(0,F);if(U=U.slice(F+1),F=U.indexOf(`

15`),!r.trim())continue;let z;try{z=JSON.parse(r)}catch(T){A(K,{id:null,error:C(-32700,`Invalid JSON: ${T instanceof Error?T.message:String(T)}`)});continue}if(z.id!==void 0&&!z.method&&V.has(z.id)){V.delete(z.id),y.sendMessage(z);continue}if(z.id!==void 0&&z.method==="initialize"){A(K,{id:z.id,result:{userAgent:"coder-broker"}});continue}if(z.method==="initialized"&&z.id===void 0)continue;if(z.id!==void 0&&z.method==="broker/shutdown")A(K,{id:z.id,result:{}}),await w(D),x.exit(0);if(z.id===void 0||!z.method)continue;let s=Z1(z)&&H&&H!==K&&!X;if((X&&X!==K||H&&H!==K)&&!s){A(K,{id:z.id,error:C(M$, ...

16`),x.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-55javascript

1#!/usr/bin/env node

2var nz=Object.defineProperty;var br=(r,i)=>{for(var $ in i)nz(r,$,{get:i[$],enumerable:!0,configurable:!0,set:(u)=>i[$]=()=>u})};

Source & flagged code

5 flagged · loading source

dist/lib/broker.jsView file

1#!/usr/bin/env node L2: var T$=Object.defineProperty;var Q1=($,W)=>{for(var q in W)T$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import W1 from"node:net";imp... L3: `,"utf8"),Q}function K$($,W){let q=L.join(R($,W),"job.json");if(!O.existsSync(q))return null;try{return JSON.parse(O.readFileSync(q,"utf8"))}catch{return null}}function A1($,W){let...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: var nz=Object.defineProperty;var br=(r,i)=>{for(var $ in i)nz(r,$,{get:i[$],enumerable:!0,configurable:!0,set:(u)=>i[$]=()=>u})};import Jr from"node:process";import $i from"node:fs... L3: `,"utf8"),g}function Gr(r,i){let $=kr.join(C(r,i),"job.json");if(!p.existsSync($))return null;try{return JSON.parse(p.readFileSync($,"utf8"))}catch{return null}}function pv(r,i){le... L4: `,"utf8")}function Sr(r,i,$=40){let u=kr.join(C(r,i),"log.jsonl");if(!p.existsSync(u))return[];return p.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(-$).map((v)=>{tr... L5: `))}if(!$?.checkedAt||Date.now()-$.checkedAt>zz)try{kz(Nn.execPath,[i,"_refreshUpdate"],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function y_(r){let $=C_()?.latest??null;... L6: `)}function M(r,i={}){let $=typeof i==="number"?i:i.code??1,u=typeof i==="object"?i.hint:null,n=u==null?[]:Array.isArray(u)?u:[u];if(Xr.stderr.write(`${r} ... L25: `)} L26: `}function vu(r){let i=r.indexOf("--"),$=i===-1?r:r.slice(0,i);return $.includes("-h")||$.includes("--help")}import yr from"node:fs";import fi from"node:path";import f from"node:pr... L27: `,"utf8")}async function uu(r,i,{timeoutMs:$,onEvent:u}){l

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

35`,$=this.socket;if(!$)throw Error("codex app-server broker connection is not connected.");$.write(i)}}class wn{static async connect(r,i={}){let $=null;if(!i.disableBroker){if($=i.b... L36: `)}function k$(r,i=72){let $=String(r??"").trim().replace(/\s+/g," ");if(!$)return"";if($.length<=i)return $;return`${$.slice(0,i-3)}...`}function az(r){let i=k$(r,56);return i?`${... L37: `)}var Vn=(r)=>(i,$,u,n)=>{let v=u?{...u,async:!1}:{async:!1},g=i._zod.run({value:$,issues:[]},v);if(g instanceof Promise)throw new Kr;if(g.issues.length){let U=new(n?.Err??r)(g.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L35

Findings

4 High3 Medium7 Low

HighChild Processdist/lib/broker.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighObfuscated Payload Loaderdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function B1($,W,q=40){let Z=L.join(R($,W),"log.jsonl");if(!O.existsSync(Z))return[];return O.readFileSync(Z,"utf8").split

6${Q.stdout}`.trim();if(!Q.error&&t$(y))return{attempted:!0,delivered:!1,method:"taskkill",result:Q};if(Q.error?.code==="ENOENT")try{return Y(q),{attempted:!0,delivered:!0,method:"kill"}}

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf(`

12`)}function Z1($){return $?.method==="turn/interrupt"}function G1($){if(!$)return;u.mkdirSync(d.dirname($),{recursive:!0}),u.writeFileSync($,`${x.pid}

14`);while(F!==-1){let r=U.slice(0,F);if(U=U.slice(F+1),F=U.indexOf(`

16`),x.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-55javascript

1#!/usr/bin/env node

2var nz=Object.defineProperty;var br=(r,i)=>{for(var $ in i)nz(r,$,{get:i[$],enumerable:!0,configurable:!0,set:(u)=>i[$]=()=>u})};