registry / @wular/coder / 0.2.3

@wular/coder@0.2.3

Delegating coding-agent runtime

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 392 KB of source, external domains: 127.0.0.1, json-schema.org, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

2var A$=Object.defineProperty;var X1=($,W)=>{for(var q in W)A$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import q1 from"node:net";import r from"node:path";import L from"node:process";function e($,W={}){let q=new Set(W.valueOptions??[]),Z=new Set(W.booleanOptions??[]),K=W.aliasMap??{},X={},Q=[],G=!1;for(let z=0;z<$.length;z+=1){let M=$[z];if(G){Q.push(M);continue}if(M==="--"){G=!0;continue}if(!M.startsWith("-")||M==="-"){Q.push(M);continue}if(M.startsWith("--")){let[R,A]=M.slice(2).split("=",2),P=K[R]??R;if(Z.has(P)){X[P]=A===void 0?!0:A!=="false"; ...

3`,"utf8"),Q}function z$($){if(!$.engine&&($.agent==="codex"||$.agent==="claude"))$.engine=$.agent;return $}function u$($,W){let q=N.join(f($,W),"job.json");if(!V.existsSync(q))return null;try{return z$(JSON.parse(V.readFileSync(q,"utf8")))}catch{return null}}function A1($,W){let q=f($,W);if(!V.existsSync(q))return!1;return V.rmSync(q,{recursive:!0,force:!0}),!0}function k$($){if(!$)return!1;try{return process.kill($,0),!0}catch(W){return W.code==="EPERM"}}function I$($){try{let W=Z$("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]}).trim(),q=W?Date.parse(W ...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function E1($,W,q=40){let Z=N.join(f($,W),"log.jsonl");if(!V.existsSync(Z))return[];return V.readFileSync(Z,"utf8").split

5`,"utf8")}function a$($){let W=n($);if(O.existsSync(W))O.unlinkSync(W)}async function i$($){if(!$)return!1;try{return await M$($,150)}catch{return!1}}async function U$($,W={}){let q=W.scriptPath??n$(),Z=H$(),K=l($),X=K?.version===Z&&K?.scriptPath===q;if(K&&X&&await i$(K.endpoint))return K;if(K)G$({endpoint:K.endpoint??null,pidFile:K.pidFile??null,logFile:K.logFile??null,sessionDir:K.sessionDir??null,pid:K.pid??null,killProcess:W.killProcess??null}),a$($);let Q=m$(),z=(W.createBrokerEndpoint??W$)(Q,W.platform),M=E.join(Q,"broker.pid"),y=E.join(Q,"broker.log"),J=c$({scriptPath:q,cwd:$,endpoint:z ...

6${Q.stdout}`.trim();if(!Q.error&&d$(G))return{attempted:!0,delivered:!1,method:"taskkill",result:Q};if(Q.error?.code==="ENOENT")try{return X(q),{attempted:!0,delivered:!0,method:"kill"

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf(`

8`)}}handleLine($){if(!$.trim())return;let W;try{W=JSON.parse($)}catch(q){this.handleExit(i(`Failed to parse codex app-server JSONL: ${q instanceof Error?q.message:String(q)}`,{line:$}));return}if(W.id!==void 0&&W.method){this.handleServerRequest(W);return}if(W.id!==void 0){let q=this.pending.get(W.id);if(!q)return;if(this.pending.delete(W.id),W.error)q.reject(i(W.error.message??`codex app-server ${q.method} failed.`,W.error));else q.resolve(W.result??{});return}if(W.method&&this.notificationHandler)this.notificationHandler(W)}defaultHandleServerRequest($){let W=this.serverRequestHandler;if(!W) ...

9${K}`:""}`);this.handleExit(X)}),this.readline=e$.createInterface({input:$}),this.readline.on("line",(q)=>{this.handleLine(q)}),await this.request("initialize",{clientInfo:this.options.clientInfo??R$(),capabilities:this.options.capabilities??J$}),this.notify("initialized",{})}async close(){if(this.closed){await

10`,q=this.proc?.stdin;if(!q)throw Error("codex app-server stdin is not available.");q.write(W)}}class L$ extends t{endpoint;socket;constructor($,W={}){super($,W);this.transport="broker",this.endpoint=W.brokerEndpoint}async

11`,q=this.socket;if(!q)throw Error("codex app-server broker connection is not connected.");q.write(W)}}class d{static async connect($,W={}){let q=null;if(!W.disableBroker){if(q=W.brokerEndpoint??W.env?.[V$]??h.env[V$]??null,!q&&W.reuseExistingBroker)q=l($)?.endpoint??null;if(!q&&!W.reuseExistingBroker)q=(await U$($,{env:W.env}))?.endpoint??null}let Z=q?new L$($,{...W,brokerEndpoint:q}):new x$($,W);return await Z.initialize(),Z}}var Z1=new Set(["turn/start","review/start","thread/compact/start"]);function T$($,W,q){let Z=new Set;if(W?.threadId)Z.add(W.threadId);if($==="review/start"&&q?.reviewTh ...

12`)}function K1($){return $?.method==="turn/interrupt"}function Q1($){if(!$)return;u.mkdirSync(r.dirname($),{recursive:!0}),u.writeFileSync($,`${L.pid}

13`,"utf8")}async function Y1(){let[$,...W]=L.argv.slice(2);if($!=="serve")throw Error("Usage: node src/lib/broker.mjs serve --endpoint <value> [--cwd <path>] [--pid-file <path>]");let{options:q}=e(W,{valueOptions:["cwd","pid-file","endpoint"]});if(!

14`);while(F!==-1){let s=U.slice(0,F);if(U=U.slice(F+1),F=U.indexOf(`

15`),!s.trim())continue;let H;try{H=JSON.parse(s)}catch(x){T(Y,{id:null,error:C(-32700,`Invalid JSON: ${x instanceof Error?x.message:String(x)}`)});continue}if(H.id!==void 0&&!H.method&&R.has(H.id)){R.delete(H.id),G.sendMessage(H);continue}if(H.id!==void 0&&H.method==="initialize"){T(Y,{id:H.id,result:{userAgent:"coder-broker"}});continue}if(H.method==="initialized"&&H.id===void 0)continue;if(H.id!==void 0&&H.method==="broker/shutdown")T(Y,{id:H.id,result:{}}),await g(D),L.exit(0);if(H.id===void 0||!H.method)continue;let o=K1(H)&&M&&M!==Y&&!z;if((z&&z!==Y||M&&M!==Y)&&!o){T(Y,{id:H.id,error:C(y$, ...

16`),L.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-66javascript

1#!/usr/bin/env node

2var Gz=Object.defineProperty;var Mr=(r,$)=>{for(var v in $)Gz(r,v,{get:$[v],enumerable:!0,configurable:!0,set:(u)=>$[v]=()=>u})};

Source & flagged code

5 flagged · loading source

dist/lib/broker.jsView file

1#!/usr/bin/env node L2: var A$=Object.defineProperty;var X1=($,W)=>{for(var q in W)A$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import q1 from"node:net";imp... L3: `,"utf8"),Q}function z$($){if(!$.engine&&($.agent==="codex"||$.agent==="claude"))$.engine=$.agent;return $}function u$($,W){let q=N.join(f($,W),"job.json");if(!V.existsSync(q))retu...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

dist/cli.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: var Gz=Object.defineProperty;var Mr=(r,$)=>{for(var v in $)Gz(r,v,{get:$[v],enumerable:!0,configurable:!0,set:(u)=>$[v]=()=>u})};import Wr from"node:process";import _$ from"node:fs... L3: `,"utf8"),g}function i1(r){if(!r.engine&&(r.agent==="codex"||r.agent==="claude"))r.engine=r.agent;return r}function Tr(r,$){let v=h.join(o(r,$),"job.json");if(!d.existsSync(v))retu... L4: `,"utf8")}function Ar(r,$,v=40){let u=h.join(o(r,$),"log.jsonl");if(!d.existsSync(u))return[];return d.readFileSync(u,"utf8").split(/\r?\n/).filter(Boolean).slice(-v).map((i)=>{try... L5: L6: `))}if(!v?.checkedAt||Date.now()-v.checkedAt>Fz)try{Tz(On.execPath,[$,"_refreshUpdate"],{detached:!0,stdio:"ignore"}).unref()}catch{}}async function _1(r){let v=g1()?.latest??null;... L7: `)}function G(r,$={}){let v=typeof $==="number"?$:$.code??1,u=typeof $==="object"?$.hint:null,n=u==null?[]:Array.isArray(u)?u:[u];if(qr.stderr.write(`${r} ... L36: `)} L37: `}function Ov(r){let $=r.indexOf("--"),v=$===-1?r:r.slice(0,$);return v.includes("-h")||v.includes("--help")}import er from"node:fs";import nv from"node:path";import f from"node:pr... L38: `,"utf8")}async function Ku(r,$,{timeoutMs:v,onEvent:

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

46`,v=this.socket;if(!v)throw Error("codex app-server broker connection is not connected.");v.write($)}}class Kn{static async connect(r,$={}){let v=null;if(!$.disableBroker){if(v=$.b... L47: `)}function wv(r,$=72){let v=String(r??"").trim().replace(/\s+/g," ");if(!v)return"";if(v.length<=$)return v;return`${v.slice(0,$-3)}...`}function VN(r){let $=wv(r,56);return $?`${... L48: `)}var Gn=(r)=>($,v,u,n)=>{let i=u?{...u,async:!1}:{async:!1},g=$._zod.run({value:v,issues:[]},i);if(g instanceof Promise)throw new Lr;if(g.issues.length){let I=new(n?.Err??r)(g.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli.jsView on unpkg · L46

Findings

4 High3 Medium7 Low

HighChild Processdist/lib/broker.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighObfuscated Payload Loaderdist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function E1($,W,q=40){let Z=N.join(f($,W),"log.jsonl");if(!V.existsSync(Z))return[];return V.readFileSync(Z,"utf8").split

6${Q.stdout}`.trim();if(!Q.error&&d$(G))return{attempted:!0,delivered:!1,method:"taskkill",result:Q};if(Q.error?.code==="ENOENT")try{return X(q),{attempted:!0,delivered:!0,method:"kill"

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf(`

12`)}function K1($){return $?.method==="turn/interrupt"}function Q1($){if(!$)return;u.mkdirSync(r.dirname($),{recursive:!0}),u.writeFileSync($,`${L.pid}

14`);while(F!==-1){let s=U.slice(0,F);if(U=U.slice(F+1),F=U.indexOf(`

16`),L.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-66javascript

1#!/usr/bin/env node

2var Gz=Object.defineProperty;var Mr=(r,$)=>{for(var v in $)Gz(r,v,{get:$[v],enumerable:!0,configurable:!0,set:(u)=>$[v]=()=>u})};