registry / @yuandc/aica / 0.1.9

@yuandc/aica@0.1.9

AICA remote Agent worker

Static Scan Results

scanned 22h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 54 file(s), 214 KB of source, external domains: aca.kinghon.com.cn

Source & flagged code

2 flagged

dist/core/aca-config.jsView file

Lines 1-2javascript

1import{readJsonFile as f,writeJsonFile as s}from"./fs.js";import{getAcaConfigPath as d}from"./paths.js";import{randomUUID as u}from"node:crypto";import m from"node:os";const p="https://aca.kinghon.com.cn:8843/";function o(){const e=f(d())??{};return{serverUrl:e.serverUrl||process.env.ACA_DEFAULT_SERVER_URL||p,token:e.token,username:e.username,machineId:e.machineId||u(),machineName:e.machineName||m.hostname(),defaultWorkspaceId:e.defaultWorkspaceId||"default",defaultProjectId:e.defaultProjectId,projects:Array.isArray(e.projects)?e.projects:[]}}function P(e={}){const t=f(d())??{},n={...o(),...e. ...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/aca-config.jsView on unpkg · L1

Long lines were clipped for display.

dist/commands/daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @yuandc/aica@0.1.6 matchedIdentity = npm:QHl1YW5kYy9haWNh:0.1.6 similarity = 0.860 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/daemon.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/core/aca-config.jsView file

1import{readJsonFile as f,writeJsonFile as s}from"./fs.js";import{getAcaConfigPath as d}from"./paths.js";import{randomUUID as u}from"node:crypto";import m from"node:os";const p="htt...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/aca-config.jsView on unpkg · L1

dist/commands/daemon.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/daemon.jsView on unpkg

Findings

2 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/core/aca-config.js

HighPrevious Version Dangerous Deltadist/commands/daemon.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License