registry / @zhin.js/agent / 1.0.3

@zhin.js/agent@1.0.3

Zhin AI Agent — session, ZhinAgent, init; composes @zhin.js/core providers and tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 442 file(s), 1.52 MB of source, external domains: console.zhin.dev, example.com, www.bing.com

Source & flagged code

3 flagged

lib/security/sandbox.jsView file

Lines 159-199javascript

159 });

160}

161// ── 命令验证 ──────────────────────────────────────────────────────────

162function matchDangerousSandboxCommand(command) {

163 const lower = command.toLowerCase();

164 if ((lower.includes('curl') || lower.includes('wget')) &&

165 lower.includes('|') &&

166 /\bsh\b/.test(lower)) {

167 return '沙箱内禁止执行危险命令模式: curl|sh / wget|sh 类管道';

168 }

169 if ((lower.includes('curl') || lower.includes('wget')) &&

170 lower.includes('&&') &&

171 lower.includes('./')) {

172 return '沙箱内禁止执行危险命令模式: curl/wget 下载后直接执行';

173 }

174 if (/\b(?:rm|rmdir)\b/.test(lower) && lower.includes('node_modules')) {

175 return '沙箱内禁止执行危险命令模式: 删除 node_modules';

176 }

177 if (lower.includes('find') && lower.includes('node_modules') && lower.includes('-delete')) {

178 return '沙箱内禁止执行危险命令模式: find -delete node_modules';

179 }

180 if (lower.includes('eval(') || lower.includes('exec(')) {

181 return '沙箱内禁止执行危险命令模式: eval/exec';

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/security/sandbox.jsView on unpkg · L179

182 }

183 if (lower.includes('child_process') || lower.includes('spawn(') || lower.includes('fork(')) {

184 return '沙箱内禁止执行危险命令模式: 进程注入相关调用';

185 }

186 return undefined;

187}

188/**

189 * 验证命令是否在沙箱允许范围内

190 */

191function validateCommand(command, config) {

192 // 检查是否尝试更改目录

193 if (/\bcd\s/.test(command)) {

194 return { valid: false, reason: '沙箱内禁止使用 cd 命令' };

195 }

196 // 检查是否尝试访问沙箱外的文件

197 if (config.workingDirectory) {

198 // 检查绝对路径访问

199 const absolutePathPattern = /(?:^|\s|;|&&|\|\|)(\/[^\s;|&`"'{}[\]()]+?)(?:\s|$|;|&&|\|\|)/g;

Lines 238-278javascript

238 return { valid: false, reason: networkCheck.reason };

239 }

240 return { valid: true };

241}

242// ── 沙箱执行器 ────────────────────────────────────────────────────────

243export class Sandbox {

244 config;

245 _dockerAvailable = null; // 缓存检测结果

lib/security/network-policy.jsView file

Lines 13-53javascript

13 /\bnetcat\s+/,

14 /\bssh\s+/,

15 /\bscp\s+/,

16 /\brsync\s+/,

Source & flagged code

3 flagged · loading source

lib/security/sandbox.jsView file

258try { L259: const { isDockerAvailable } = require('./sandbox-docker.js'); L260: this._dockerAvailable = isDockerAvailable();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/security/sandbox.jsView on unpkg · L258

179} L180: if (lower.includes('eval(') || lower.includes('exec(')) { L181: return '沙箱内禁止执行危险命令模式: eval/exec';

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/security/sandbox.jsView on unpkg · L179

lib/security/network-policy.jsView file

33h.endsWith('.local') || L34: // IPv4 private ranges L35: h.startsWith('10.') || ... L103: allowed: false, L104: reason: `启用 allowedDomains 时，网络命令必须包含可校验的 URL（如 http://example.com）`, L105: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/security/network-policy.jsView on unpkg · L33

Findings

1 High4 Medium5 Low

HighCloud Metadata Accesslib/security/network-policy.js

MediumDynamic Requirelib/security/sandbox.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallib/security/sandbox.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/security/sandbox.jsView file

Lines 159-199javascript

159 });

160}

161// ── 命令验证 ──────────────────────────────────────────────────────────

162function matchDangerousSandboxCommand(command) {

163 const lower = command.toLowerCase();

164 if ((lower.includes('curl') || lower.includes('wget')) &&

165 lower.includes('|') &&

166 /\bsh\b/.test(lower)) {

167 return '沙箱内禁止执行危险命令模式: curl|sh / wget|sh 类管道';

168 }

169 if ((lower.includes('curl') || lower.includes('wget')) &&

170 lower.includes('&&') &&

171 lower.includes('./')) {

172 return '沙箱内禁止执行危险命令模式: curl/wget 下载后直接执行';

173 }

174 if (/\b(?:rm|rmdir)\b/.test(lower) && lower.includes('node_modules')) {

175 return '沙箱内禁止执行危险命令模式: 删除 node_modules';

176 }

177 if (lower.includes('find') && lower.includes('node_modules') && lower.includes('-delete')) {

178 return '沙箱内禁止执行危险命令模式: find -delete node_modules';

179 }

180 if (lower.includes('eval(') || lower.includes('exec(')) {

181 return '沙箱内禁止执行危险命令模式: eval/exec';

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/security/sandbox.jsView on unpkg · L179

182 }

183 if (lower.includes('child_process') || lower.includes('spawn(') || lower.includes('fork(')) {

184 return '沙箱内禁止执行危险命令模式: 进程注入相关调用';

185 }

186 return undefined;

187}

188/**

189 * 验证命令是否在沙箱允许范围内

190 */

191function validateCommand(command, config) {

192 // 检查是否尝试更改目录

193 if (/\bcd\s/.test(command)) {

194 return { valid: false, reason: '沙箱内禁止使用 cd 命令' };

195 }

196 // 检查是否尝试访问沙箱外的文件

197 if (config.workingDirectory) {

198 // 检查绝对路径访问

199 const absolutePathPattern = /(?:^|\s|;|&&|\|\|)(\/[^\s;|&`"'{}[\]()]+?)(?:\s|$|;|&&|\|\|)/g;

Lines 238-278javascript

238 return { valid: false, reason: networkCheck.reason };

239 }

240 return { valid: true };

241}

242// ── 沙箱执行器 ────────────────────────────────────────────────────────

243export class Sandbox {

244 config;

245 _dockerAvailable = null; // 缓存检测结果

lib/security/network-policy.jsView file

Lines 13-53javascript

13 /\bnetcat\s+/,

14 /\bssh\s+/,

15 /\bscp\s+/,

16 /\brsync\s+/,