registry / @wular/coder / 0.1.27

@wular/coder@0.1.27

Delegating coding-agent runtime

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 375 KB of source, external domains: json-schema.org, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

2var T$=Object.defineProperty;var Y1=($,W)=>{for(var q in W)T$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import W1 from"node:net";import r from"node:path";import L from"node:process";function e($,W={}){let q=new Set(W.valueOptions??[]),Z=new Set(W.booleanOptions??[]),K=W.aliasMap??{},z={},Q=[],G=!1;for(let X=0;X<$.length;X+=1){let M=$[X];if(G){Q.push(M);continue}if(M==="--"){G=!0;continue}if(!M.startsWith("-")||M==="-"){Q.push(M);continue}if(M.startsWith("--")){let[J,A]=M.slice(2).split("=",2),P=K[J]??J;if(Z.has(P)){z[P]=A===void 0?!0:A!=="false"; ...

3`,"utf8"),Q}function C$($,W){let q=N.join(f($,W),"job.json");if(!V.existsSync(q))return null;try{return JSON.parse(V.readFileSync(q,"utf8"))}catch{return null}}function T1($,W){let q=f($,W);if(!V.existsSync(q))return!1;return V.rmSync(q,{recursive:!0,force:!0}),!0}function u$($){if(!$)return!1;try{return process.kill($,0),!0}catch(W){return W.code==="EPERM"}}function k$($){try{let W=Z$("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]}).trim(),q=W?Date.parse(W):NaN;return Number.isFinite(q)?q:null}catch{return null}}function I$($,W){if(!u$($))return!1;let q ...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function B1($,W,q=40){let Z=N.join(f($,W),"log.jsonl");if(!V.existsSync(Z))return[];return V.readFileSync(Z,"utf8").split

5`,"utf8")}function l$($){let W=n($);if(O.existsSync(W))O.unlinkSync(W)}async function a$($){if(!$)return!1;try{return await G$($,150)}catch{return!1}}async function M$($,W={}){let q=W.scriptPath??c$(),Z=X$(),K=l($),z=K?.version===Z&&K?.scriptPath===q;if(K&&z&&await a$(K.endpoint))return K;if(K)H$({endpoint:K.endpoint??null,pidFile:K.pidFile??null,logFile:K.logFile??null,sessionDir:K.sessionDir??null,pid:K.pid??null,killProcess:W.killProcess??null}),l$($);let Q=g$(),X=(W.createBrokerEndpoint??W$)(Q,W.platform),M=E.join(Q,"broker.pid"),y=E.join(Q,"broker.log"),R=p$({scriptPath:q,cwd:$,endpoint:X ...

6${Q.stdout}`.trim();if(!Q.error&&t$(G))return{attempted:!0,delivered:!1,method:"taskkill",result:Q};if(Q.error?.code==="ENOENT")try{return z(q),{attempted:!0,delivered:!0,method:"kill"

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf(`

8`)}}handleLine($){if(!$.trim())return;let W;try{W=JSON.parse($)}catch(q){this.handleExit(i(`Failed to parse codex app-server JSONL: ${q instanceof Error?q.message:String(q)}`,{line:$}));return}if(W.id!==void 0&&W.method){this.handleServerRequest(W);return}if(W.id!==void 0){let q=this.pending.get(W.id);if(!q)return;if(this.pending.delete(W.id),W.error)q.reject(i(W.error.message??`codex app-server ${q.method} failed.`,W.error));else q.resolve(W.result??{});return}if(W.method&&this.notificationHandler)this.notificationHandler(W)}defaultHandleServerRequest($){let W=this.serverRequestHandler;if(!W) ...

9${K}`:""}`);this.handleExit(z)}),this.readline=s$.createInterface({input:$}),this.readline.on("line",(q)=>{this.handleLine(q)}),await this.request("initialize",{clientInfo:this.options.clientInfo??y$(),capabilities:this.options.capabilities??J$}),this.notify("initialized",{})}async close(){if(this.closed){await

10`,q=this.proc?.stdin;if(!q)throw Error("codex app-server stdin is not available.");q.write(W)}}class x$ extends t{endpoint;socket;constructor($,W={}){super($,W);this.transport="broker",this.endpoint=W.brokerEndpoint}async

11`,q=this.socket;if(!q)throw Error("codex app-server broker connection is not connected.");q.write(W)}}class d{static async connect($,W={}){let q=null;if(!W.disableBroker){if(q=W.brokerEndpoint??W.env?.[N$]??h.env[N$]??null,!q&&W.reuseExistingBroker)q=l($)?.endpoint??null;if(!q&&!W.reuseExistingBroker)q=(await M$($,{env:W.env}))?.endpoint??null}let Z=q?new x$($,{...W,brokerEndpoint:q}):new R$($,W);return await Z.initialize(),Z}}var q1=new Set(["turn/start","review/start","thread/compact/start"]);function L$($,W,q){let Z=new Set;if(W?.threadId)Z.add(W.threadId);if($==="review/start"&&q?.reviewTh ...

12`)}function Z1($){return $?.method==="turn/interrupt"}function K1($){if(!$)return;u.mkdirSync(r.dirname($),{recursive:!0}),u.writeFileSync($,`${L.pid}

13`,"utf8")}async function Q1(){let[$,...W]=L.argv.slice(2);if($!=="serve")throw Error("Usage: node src/lib/broker.mjs serve --endpoint <value> [--cwd <path>] [--pid-file <path>]");let{options:q}=e(W,{valueOptions:["cwd","pid-file","endpoint"]});if(!

14`);while(F!==-1){let o=U.slice(0,F);if(U=U.slice(F+1),F=U.indexOf(`

15`),!o.trim())continue;let H;try{H=JSON.parse(o)}catch(x){T(Y,{id:null,error:C(-32700,`Invalid JSON: ${x instanceof Error?x.message:String(x)}`)});continue}if(H.id!==void 0&&!H.method&&J.has(H.id)){J.delete(H.id),G.sendMessage(H);continue}if(H.id!==void 0&&H.method==="initialize"){T(Y,{id:H.id,result:{userAgent:"coder-broker"}});continue}if(H.method==="initialized"&&H.id===void 0)continue;if(H.id!==void 0&&H.method==="broker/shutdown")T(Y,{id:H.id,result:{}}),await b(D),L.exit(0);if(H.id===void 0||!H.method)continue;let s=Z1(H)&&M&&M!==Y&&!X;if((X&&X!==Y||M&&M!==Y)&&!s){T(Y,{id:H.id,error:C(O$, ...

16`),L.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-55javascript

1#!/usr/bin/env node

2var $z=Object.defineProperty;var Qr=(r,i)=>{for(var $ in i)$z(r,$,{get:i[$],enumerable:!0,configurable:!0,set:(u)=>i[$]=()=>u})};

Source & flagged code

5 flagged · loading source

dist/lib/broker.jsView file

1#!/usr/bin/env node L2: var T$=Object.defineProperty;var Y1=($,W)=>{for(var q in W)T$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import W1 from"node:net";imp... L3: `,"utf8"),Q}function C$($,W){let q=N.join(f($,W),"job.json");if(!V.existsSync(q))return null;try{return JSON.parse(V.readFileSync(q,"utf8"))}catch{return null}}function T1($,W){let...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: var $z=Object.defineProperty;var Qr=(r,i)=>{for(var $ in i)$z(r,$,{get:i[$],enumerable:!0,configurable:!0,set:(u)=>i[$]=()=>u})};import Jr from"node:process";import $i from"node:fs... L3: `,"utf8"),g}function Sr(r,i){let $=d.join(C(r,i),"job.json");if(!e.existsSync($))return null;try{return JSON.parse(e.readFileSync($,"utf8"))}catch{return null}}function av(r,i){let... L4: `,"utf8")}function Lr(r,i,$=40){let u=d.join(C(r,i),"log.jsonl");if(!e.existsSync(u))return[];return e.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(-$).map((v)=>{try... L5: `))}if(!$?.checkedAt||Date.now()-$.checkedAt>Nz)try{Dz(Nn.execPath,[i,"_refreshUpdate"],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function d_(r){let $=f_()?.latest??null;... L6: `)}function M(r,i={}){let $=typeof i==="number"?i:i.code??1,u=typeof i==="object"?i.hint:null,n=u==null?[]:Array.isArray(u)?u:[u];if(wr.stderr.write(`${r} ... L25: `)} L26: `}function uu(r){let i=r.indexOf("--"),$=i===-1?r:r.slice(0,i);return $.includes("-h")||$.includes("--help")}import hr from"node:fs";import fi from"node:path";import f from"node:pr... L27: `,"utf8")}async function gu(r,i,{timeoutMs:$,onEvent:u}){l

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

35`,$=this.socket;if(!$)throw Error("codex app-server broker connection is not connected.");$.write(i)}}class Xn{static async connect(r,i={}){let $=null;if(!i.disableBroker){if($=i.b... L36: `)}function D$(r,i=72){let $=String(r??"").trim().replace(/\s+/g," ");if(!$)return"";if($.length<=i)return $;return`${$.slice(0,i-3)}...`}function sz(r){let i=D$(r,56);return i?`${... L37: `)}var Gn=(r)=>(i,$,u,n)=>{let v=u?{...u,async:!1}:{async:!1},g=i._zod.run({value:$,issues:[]},v);if(g instanceof Promise)throw new Kr;if(g.issues.length){let U=new(n?.Err??r)(g.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L35

Findings

4 High3 Medium7 Low

HighChild Processdist/lib/broker.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighObfuscated Payload Loaderdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function B1($,W,q=40){let Z=N.join(f($,W),"log.jsonl");if(!V.existsSync(Z))return[];return V.readFileSync(Z,"utf8").split

6${Q.stdout}`.trim();if(!Q.error&&t$(G))return{attempted:!0,delivered:!1,method:"taskkill",result:Q};if(Q.error?.code==="ENOENT")try{return z(q),{attempted:!0,delivered:!0,method:"kill"

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf(`

12`)}function Z1($){return $?.method==="turn/interrupt"}function K1($){if(!$)return;u.mkdirSync(r.dirname($),{recursive:!0}),u.writeFileSync($,`${L.pid}

14`);while(F!==-1){let o=U.slice(0,F);if(U=U.slice(F+1),F=U.indexOf(`

16`),L.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-55javascript

1#!/usr/bin/env node

2var $z=Object.defineProperty;var Qr=(r,i)=>{for(var $ in i)$z(r,$,{get:i[$],enumerable:!0,configurable:!0,set:(u)=>i[$]=()=>u})};