registry / @wular/coder / 0.1.8

@wular/coder@0.1.8

Delegating coding-agent runtime

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 348 KB of source, external domains: json-schema.org, registry.npmjs.org

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2var VU=Object.defineProperty;var Nr=(r,i)=>{for(var v in i)VU(r,v,{get:i[v],enumerable:!0,configurable:!0,set:(u)=>i[v]=()=>u})};import d from"node:fs";import x from"node:path";import W from"node:process";import{spawn as Wk,spawnSync as Kr}from"node:child_process";import{fileURLToPath as u$}from"node:url";function nr(r,i={}){let v=new Set(i.valueOptions??[]),u=new Set(i.booleanOptions??[]),n=i.aliasMap??{},$={},t=[],g=!1;for(let I=0;I<r.length;I+=1){let o=r[I];if(g){t.push(o);continue}if(o==="--"){g=!0;continue}if(!o.startsWith("-")||o==="-"){t.push(o);continue}if(o.startsWith("--")){let[k,b]= ...

3`,"utf8"),t}function er(r,i){let v=Ir.join(ir(r,i),"job.json");if(!lr.existsSync(v))return null;try{return JSON.parse(lr.readFileSync(v,"utf8"))}catch{return null}}function t$(r){let i=Y6(r);if(!lr.existsSync(i))return[];return lr.readdirSync(i).map((v)=>er(r,v)).filter(Boolean).sort((v,u)=>String(u.updatedAt??"").localeCompare(String(v.updatedAt??"")))}function g$(r,i){let v=t$(r);if(!i)return v[0]??null;let u=v.find(($)=>$.id===i);if(u)return u;let n=v.filter(($)=>$.id.startsWith(i));if(n.length===1)return n[0];if(n.length>1)throw Error(`Job reference "${i}" is ambiguous. Use a longer id.`); ...

4`,"utf8")}function o$(r,i,v=40){let u=Ir.join(ir(r,i),"log.jsonl");if(!lr.existsSync(u))return[];return lr.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(

5`,"utf8")}function ZU(r){let i=l$(r);if(F.existsSync(i))F.unlinkSync(i)}async function fU(r){if(!r)return!1;try{return await B6(r,150)}catch{return!1}}async function M6(r,i={}){let v=U$(r);if(v&&await fU(v.endpoint))return v;if(v)E6({endpoint:v.endpoint??null,pidFile:v.pidFile??null,logFile:v.logFile??null,sessionDir:v.sessionDir??null,pid:v.pid??null,killProcess:i.killProcess??null}),ZU(r);let u=TU(),$=(i.createBrokerEndpoint??A6)(u,i.platform),t=Cr.join(u,"broker.pid"),g=Cr.join(u,"broker.log"),I=i.scriptPath??RU(),o=xU({scriptPath:I,cwd:r,endpoint:$,pidFile:t,logFile:g,env:i.env??I$.env});i ...

6${$.stdout}`.trim();if(!$.error&&CU(t))return{attempted:!0,delivered:!1,method:"taskkill",result:$};if($.error?.code==="ENOENT")try{return n(r),{attempted:!0,delivered:!0,method:"kill"}}catch(g){if(g?.code==="ESRCH")

7`);while(i!==-1){let v=this.lineBuffer.slice(0,i);this.lineBuffer=this.lineBuffer.slice(i+1),this.handleLine(v),i=this.lineBuffer.indexOf(`

8`)}}handleLine(r){if(!r.trim())return;let i;try{i=JSON.parse(r)}catch(v){this.handleExit(c$(`Failed to parse codex app-server JSONL: ${v.message}`,{line:r}));return}if(i.id!==void 0&&i.method){this.handleServerRequest(i);return}if(i.id!==void 0){let v=this.pending.get(i.id);if(!v)return;if(this.pending.delete(i.id),i.error)v.reject(c$(i.error.message??`codex app-server ${v.method} failed.`,i.error));else v.resolve(i.result??{});return}if(i.method&&this.notificationHandler)this.notificationHandler(i)}defaultHandleServerRequest(r){if(!this.serverRequestHandler){this.sendMessage({id:r.id,error:x6 ...

9${v}`:""}`);this.handleExit(u)}),this.readline=pU.createInterface({input:this.proc.stdout}),this.readline.on("line",(r)=>{this.handleLine(r)}),await this.request("initialize",{clientInfo:this.options.clientInfo??m6,capabilities:this.options.capabilities??Z6}),this.notify("initialized",{})}async close(){if(this.closed){await this.exitPromise;return}if(this.closed=!0,this.readline)this.readline.close();if(this.proc&&!this.proc.killed)this.proc.stdin.end(),setTimeout(()=>{if(this.proc&&!this.proc.killed&&this.proc.exitCode===null)if(An.platform==="win32")try{F6(this.proc.pid)}catch{}else this.pro ...

10`,v=this.proc?.stdin;if(!v)throw Error("codex app-server stdin is not available.");v.write(i)}}class e6 extends b${endpoint;socket;constructor(r,i={}){super(r,i);this.transport="broker",this.endpoint=i.brokerEndpoint}async initialize

11`,v=this.socket;if(!v)throw Error("codex app-server broker connection is not connected.");v.write(i)}}class yr{static async connect(r,i={}){let v=null;if(!i.disableBroker){if(v=i.brokerEndpoint??i.env?.[Ji]??An.env[Ji]??null,!v&&i.reuseExistingBroker)v=U$(r)?.endpoint??null;if(!v&&!i.reuseExistingBroker)v=(await M6(r,{env:i.env}))?.endpoint??null}let u=v?new e6(r,{...i,brokerEndpoint:v}):new f6(r,i);return await u.initialize(),u}}var sU="coder_runtime",C6="Coder Task";function r_(r){return r.split(/\r?\n/).map((i)=>i.trimEnd()).filter((i)=>i&&!i.startsWith("WARNING: proceeding, even though we ...

12`)}function Pi(r,i=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=i)return v;return`${v.slice(

13`)}var rn=(r)=>(i,v,u,n)=>{let $=u?{...u,async:!1}:{async:!1},t=i._zod.run({value:v,issues:[]},$);if(t instanceof Promise)throw new _r;if(t.issues.length){let g=new(n?.Err??r)(t.issues.map((I)=>e(I,$,E())));throw Li(g,n?.callee),g}return t.value},Gi=rn(s),nn=(r)=>async(i,v,u,n)=>{let $=u?{...u,async:!0}:{async:!0},t=i._zod.run({value:v,issues:[]},$);if(t instanceof Promise)t=await t;if(t.issues.length){let g=new(n?.Err??r)(t.issues.map((I)=>e(I,$,E())));throw Li(g,n?.callee),g}return t.value},Vi=nn(s),vn=(r)=>(i,v,u)=>{let n=u?{...u,async:!1}:{async:!1},$=i._zod.run({value:v,issues:[]},n);if($ ...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L11

14`).filter(($)=>$),u=Math.min(...v.map(($)=>$.length-$.trimStart().length)),n=v.map(($)=>$.slice(u)).map(($)=>" ".repeat(this.indent*2)

15`))}}var Xu={major:4,minor:4,patch:3};var L=U("$ZodType",(r,i)=>{var v;r??(r={}),r._zod.def=i,r._zod.bag=r._zod.bag||{},r._zod.version=Xu;let u=[...r._zod.def.checks??[]];if(r._zod.traits.has("$ZodCheck"

16 if (${q}.issues.length) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

17 if (${H} in input) {

18 payload.issues = payload.issues.concat(${q}.issues.map(iss => ({

19 ...iss,

20 path: iss.path ? [${H}, ...iss.path] : [${H}]

21 })));

22 }

23 }

25 if (${q}.value === undefined) {

26 if (${H} in input) {

27 newResult[${H}] = undefined;

28 }

29 } else {

30 newResult[${H}] = ${q}.value;

31 }

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: var VU=Object.defineProperty;var Nr=(r,i)=>{for(var v in i)VU(r,v,{get:i[v],enumerable:!0,configurable:!0,set:(u)=>i[v]=()=>u})};import d from"node:fs";import x from"node:path";imp... L3: `,"utf8"),t}function er(r,i){let v=Ir.join(ir(r,i),"job.json");if(!lr.existsSync(v))return null;try{return JSON.parse(lr.readFileSync(v,"utf8"))}catch{return null}}function t$(r){l... L4: `,"utf8")}function o$(r,i,v=40){let u=Ir.join(ir(r,i),"log.jsonl");if(!lr.existsSync(u))return[];return lr.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(-v).map(($)=>... L5: `,"utf8")}function ZU(r){let i=l$(r);if(F.existsSync(i))F.unlinkSync(i)}async function fU(r){if(!r)return!1;try{return await B6(r,150)}catch{return!1}}async function M6(r,i={}){let... L6: ${$.stdout}`.trim();if(!$.error&&CU(t))return{attempted:!0,delivered:!1,method:"taskkill",result:$};if($.error?.code==="ENOENT")try{return n(r),{attempted:!0,delivered:!0,method:"k... ... L14: `).filter(($)=>$),u=Math.min(...v.map(($)=>$.length-$.trimStart().length)),n=v.map(($)=>$.slice(u)).map(($)=>" ".repeat(this.indent*2)+$);for(let $ of n)this.content.push($)}compil... L15: `))}}var Xu={major:4,minor:4,patch:3};

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

11`,v=this.socket;if(!v)throw Error("codex app-server broker connection is not connected.");v.write(i)}}class yr{static async connect(r,i={}){let v=null;if(!i.disableBroker){if(v=i.b... L12: `)}function Pi(r,i=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=i)return v;return`${v.slice(0,i-3)}...`}function n_(r){let i=Pi(r,56);return i?`${... L13: `)}var rn=(r)=>(i,v,u,n)=>{let $=u?{...u,async:!1}:{async:!1},t=i._zod.run({value:v,issues:[]},$);if(t instanceof Promise)throw new _r;if(t.issues.length){let g=new(n?.Err??r)(t.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L11

Findings

3 High3 Medium7 Low

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighObfuscated Payload Loaderdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

4`,"utf8")}function o$(r,i,v=40){let u=Ir.join(ir(r,i),"log.jsonl");if(!lr.existsSync(u))return[];return lr.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(

7`);while(i!==-1){let v=this.lineBuffer.slice(0,i);this.lineBuffer=this.lineBuffer.slice(i+1),this.handleLine(v),i=this.lineBuffer.indexOf(`

12`)}function Pi(r,i=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=i)return v;return`${v.slice(

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L11

14`).filter(($)=>$),u=Math.min(...v.map(($)=>$.length-$.trimStart().length)),n=v.map(($)=>$.slice(u)).map(($)=>" ".repeat(this.indent*2)

16 if (${q}.issues.length) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

17 if (${H} in input) {

18 payload.issues = payload.issues.concat(${q}.issues.map(iss => ({

19 ...iss,

20 path: iss.path ? [${H}, ...iss.path] : [${H}]

21 })));

22 }

23 }

25 if (${q}.value === undefined) {

26 if (${H} in input) {

27 newResult[${H}] = undefined;

28 }

29 } else {

30 newResult[${H}] = ${q}.value;

31 }

Long lines were clipped for display.