registry / @wular/coder / 0.1.7

@wular/coder@0.1.7

Delegating coding-agent runtime

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsEvalFilesystem

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 344 KB of source, external domains: json-schema.org

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2var _c=Object.defineProperty;var zr=(r,i)=>{for(var v in i)_c(r,v,{get:i[v],enumerable:!0,configurable:!0,set:(u)=>i[v]=()=>u})};import h from"node:fs";import F from"node:path";import G from"node:process";import{spawn as $b,spawnSync as mr}from"node:child_process";import{fileURLToPath as Ni}from"node:url";function vr(r,i={}){let v=new Set(i.valueOptions??[]),u=new Set(i.booleanOptions??[]),n=i.aliasMap??{},$={},t=[],o=!1;for(let l=0;l<r.length;l+=1){let g=r[l];if(o){t.push(g);continue}if(g==="--"){o=!0;continue}if(!g.startsWith("-")||g==="-"){t.push(g);continue}if(g.startsWith("--")){let[b,k]= ...

3`,"utf8"),t}function Zr(r,i){let v=gr.join(rr(r,i),"job.json");if(!lr.existsSync(v))return null;try{return JSON.parse(lr.readFileSync(v,"utf8"))}catch{return null}}function i$(r){let i=G6(r);if(!lr.existsSync(i))return[];return lr.readdirSync(i).map((v)=>Zr(r,v)).filter(Boolean).sort((v,u)=>String(u.updatedAt??"").localeCompare(String(v.updatedAt??"")))}function v$(r,i){let v=i$(r);if(!i)return v[0]??null;let u=v.find(($)=>$.id===i);if(u)return u;let n=v.filter(($)=>$.id.startsWith(i));if(n.length===1)return n[0];if(n.length>1)throw Error(`Job reference "${i}" is ambiguous. Use a longer id.`); ...

4`,"utf8")}function $$(r,i,v=40){let u=gr.join(rr(r,i),"log.jsonl");if(!lr.existsSync(u))return[];return lr.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(

5`,"utf8")}function jc(r){let i=t$(r);if(T.existsSync(i))T.unlinkSync(i)}async function qc(r){if(!r)return!1;try{return await q6(r,150)}catch{return!1}}async function Y6(r,i={}){let v=o$(r);if(v&&await qc(v.endpoint))return v;if(v)j6({endpoint:v.endpoint??null,pidFile:v.pidFile??null,logFile:v.logFile??null,sessionDir:v.sessionDir??null,pid:v.pid??null,killProcess:i.killProcess??null}),jc(r);let u=Lc(),$=(i.createBrokerEndpoint??K6)(u,i.platform),t=fr.join(u,"broker.pid"),o=fr.join(u,"broker.log"),l=i.scriptPath??Xc(),g=Vc({scriptPath:l,cwd:r,endpoint:$,pidFile:t,logFile:o,env:i.env??u$.env});i ...

6${$.stdout}`.trim();if(!$.error&&Qc(t))return{attempted:!0,delivered:!1,method:"taskkill",result:$};if($.error?.code==="ENOENT")try{return n(r),{attempted:!0,delivered:!0,method:"kill"}}catch(o){if(o?.code==="ESRCH")

7`);while(i!==-1){let v=this.lineBuffer.slice(0,i);this.lineBuffer=this.lineBuffer.slice(i+1),this.handleLine(v),i=this.lineBuffer.indexOf(`

8`)}}handleLine(r){if(!r.trim())return;let i;try{i=JSON.parse(r)}catch(v){this.handleExit(l$(`Failed to parse codex app-server JSONL: ${v.message}`,{line:r}));return}if(i.id!==void 0&&i.method){this.handleServerRequest(i);return}if(i.id!==void 0){let v=this.pending.get(i.id);if(!v)return;if(this.pending.delete(i.id),i.error)v.reject(l$(i.error.message??`codex app-server ${v.method} failed.`,i.error));else v.resolve(i.result??{});return}if(i.method&&this.notificationHandler)this.notificationHandler(i)}defaultHandleServerRequest(r){if(!this.serverRequestHandler){this.sendMessage({id:r.id,error:H6 ...

9${v}`:""}`);this.handleExit(u)}),this.readline=Bc.createInterface({input:this.proc.stdout}),this.readline.on("line",(r)=>{this.handleLine(r)}),await this.request("initialize",{clientInfo:this.options.clientInfo??B6,capabilities:this.options.capabilities??M6}),this.notify("initialized",{})}async close(){if(this.closed){await this.exitPromise;return}if(this.closed=!0,this.readline)this.readline.close();if(this.proc&&!this.proc.killed)this.proc.stdin.end(),setTimeout(()=>{if(this.proc&&!this.proc.killed&&this.proc.exitCode===null)if(Yn.platform==="win32")try{A6(this.proc.pid)}catch{}else this.pro ...

10`,v=this.proc?.stdin;if(!v)throw Error("codex app-server stdin is not available.");v.write(i)}}class F6 extends I${endpoint;socket;constructor(r,i={}){super(r,i);this.transport="broker",this.endpoint=i.brokerEndpoint}async initialize

11`,v=this.socket;if(!v)throw Error("codex app-server broker connection is not connected.");v.write(i)}}class Cr{static async connect(r,i={}){let v=null;if(!i.disableBroker){if(v=i.brokerEndpoint??i.env?.[wi]??Yn.env[wi]??null,!v&&i.reuseExistingBroker)v=o$(r)?.endpoint??null;if(!v&&!i.reuseExistingBroker)v=(await Y6(r,{env:i.env}))?.endpoint??null}let u=v?new F6(r,{...i,brokerEndpoint:v}):new T6(r,i);return await u.initialize(),u}}var Tc="coder_runtime",e6="Coder Task";function Fc(r){return r.split(/\r?\n/).map((i)=>i.trimEnd()).filter((i)=>i&&!i.startsWith("WARNING: proceeding, even though we ...

12`)}function Oi(r,i=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=i)return v;return`${v.slice(

13`)}var ar=(r)=>(i,v,u,n)=>{let $=u?{...u,async:!1}:{async:!1},t=i._zod.run({value:v,issues:[]},$);if(t instanceof Promise)throw new _r;if(t.issues.length){let o=new(n?.Err??r)(t.issues.map((l)=>Z(l,$,B())));throw Ji(o,n?.callee),o}return t.value},Pi=ar(p),sr=(r)=>async(i,v,u,n)=>{let $=u?{...u,async:!0}:{async:!0},t=i._zod.run({value:v,issues:[]},$);if(t instanceof Promise)t=await t;if(t.issues.length){let o=new(n?.Err??r)(t.issues.map((l)=>Z(l,$,B())));throw Ji(o,n?.callee),o}return t.value},Wi=sr(p),rn=(r)=>(i,v,u)=>{let n=u?{...u,async:!1}:{async:!1},$=i._zod.run({value:v,issues:[]},n);if($ ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L11

14`).filter(($)=>$),u=Math.min(...v.map(($)=>$.length-$.trimStart().length)),n=v.map(($)=>$.slice(u)).map(($)=>" ".repeat(this.indent*2)

15`))}}var Wu={major:4,minor:4,patch:3};var L=c("$ZodType",(r,i)=>{var v;r??(r={}),r._zod.def=i,r._zod.bag=r._zod.bag||{},r._zod.version=Wu;let u=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"

16 if (${q}.issues.length) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

17 if (${W} in input) {

18 payload.issues = payload.issues.concat(${q}.issues.map(iss => ({

19 ...iss,

20 path: iss.path ? [${W}, ...iss.path] : [${W}]

21 })));

22 }

23 }

25 if (${q}.value === undefined) {

26 if (${W} in input) {

27 newResult[${W}] = undefined;

28 }

29 } else {

30 newResult[${W}] = ${q}.value;

31 }

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: var _c=Object.defineProperty;var zr=(r,i)=>{for(var v in i)_c(r,v,{get:i[v],enumerable:!0,configurable:!0,set:(u)=>i[v]=()=>u})};import h from"node:fs";import F from"node:path";imp... L3: `,"utf8"),t}function Zr(r,i){let v=gr.join(rr(r,i),"job.json");if(!lr.existsSync(v))return null;try{return JSON.parse(lr.readFileSync(v,"utf8"))}catch{return null}}function i$(r){l... L4: `,"utf8")}function $$(r,i,v=40){let u=gr.join(rr(r,i),"log.jsonl");if(!lr.existsSync(u))return[];return lr.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(-v).map(($)=>... L5: `,"utf8")}function jc(r){let i=t$(r);if(T.existsSync(i))T.unlinkSync(i)}async function qc(r){if(!r)return!1;try{return await q6(r,150)}catch{return!1}}async function Y6(r,i={}){let... L6: ${$.stdout}`.trim();if(!$.error&&Qc(t))return{attempted:!0,delivered:!1,method:"taskkill",result:$};if($.error?.code==="ENOENT")try{return n(r),{attempted:!0,delivered:!0,method:"k... ... L14: `).filter(($)=>$),u=Math.min(...v.map(($)=>$.length-$.trimStart().length)),n=v.map(($)=>$.slice(u)).map(($)=>" ".repeat(this.indent*2)+$);for(let $ of n)this.content.push($)}compil... L15: `))}}var Wu={major:4,minor:4,patch:3};

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

11`,v=this.socket;if(!v)throw Error("codex app-server broker connection is not connected.");v.write(i)}}class Cr{static async connect(r,i={}){let v=null;if(!i.disableBroker){if(v=i.b... L12: `)}function Oi(r,i=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=i)return v;return`${v.slice(0,i-3)}...`}function ec(r){let i=Oi(r,56);return i?`${... L13: `)}var ar=(r)=>(i,v,u,n)=>{let $=u?{...u,async:!1}:{async:!1},t=i._zod.run({value:v,issues:[]},$);if(t instanceof Promise)throw new _r;if(t.issues.length){let o=new(n?.Err??r)(t.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L11

Findings

3 High2 Medium7 Low

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighObfuscated Payload Loaderdist/cli.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

4`,"utf8")}function $$(r,i,v=40){let u=gr.join(rr(r,i),"log.jsonl");if(!lr.existsSync(u))return[];return lr.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(

7`);while(i!==-1){let v=this.lineBuffer.slice(0,i);this.lineBuffer=this.lineBuffer.slice(i+1),this.handleLine(v),i=this.lineBuffer.indexOf(`

12`)}function Oi(r,i=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=i)return v;return`${v.slice(

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L11

14`).filter(($)=>$),u=Math.min(...v.map(($)=>$.length-$.trimStart().length)),n=v.map(($)=>$.slice(u)).map(($)=>" ".repeat(this.indent*2)

16 if (${q}.issues.length) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

17 if (${W} in input) {

18 payload.issues = payload.issues.concat(${q}.issues.map(iss => ({

19 ...iss,

20 path: iss.path ? [${W}, ...iss.path] : [${W}]

21 })));

22 }

23 }

25 if (${q}.value === undefined) {

26 if (${W} in input) {

27 newResult[${W}] = undefined;

28 }

29 } else {

30 newResult[${W}] = ${q}.value;

31 }

Long lines were clipped for display.