registry / @zhin.js/agent / 1.0.3

@zhin.js/agent@1.0.3

Zhin AI Agent — session, ZhinAgent, init; composes @zhin.js/core providers and tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 442 file(s), 1.52 MB of source, external domains: console.zhin.dev, example.com, www.bing.com

Source & flagged code

3 flagged

lib/security/sandbox.jsView file

Lines 159-199javascript

159 });

160}

161// ── 命令验证 ──────────────────────────────────────────────────────────

162function matchDangerousSandboxCommand(command) {

163 const lower = command.toLowerCase();

164 if ((lower.includes(

Source & flagged code

3 flagged · loading source

lib/security/sandbox.jsView file

258try { L259: const { isDockerAvailable } = require('./sandbox-docker.js'); L260: this._dockerAvailable = isDockerAvailable();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/security/sandbox.jsView on unpkg · L258

179} L180: if (lower.includes('eval(') || lower.includes('exec(')) { L181: return '沙箱内禁止执行危险命令模式: eval/exec';

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/security/sandbox.jsView on unpkg · L179

lib/security/network-policy.jsView file

33h.endsWith('.local') || L34: // IPv4 private ranges L35: h.startsWith('10.') || ... L103: allowed: false, L104: reason: `启用 allowedDomains 时，网络命令必须包含可校验的 URL（如 http://example.com）`, L105: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/security/network-policy.jsView on unpkg · L33

Findings

1 High4 Medium5 Low

HighCloud Metadata Accesslib/security/network-policy.js

MediumDynamic Requirelib/security/sandbox.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallib/security/sandbox.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 238-278javascript

238 return { valid: false, reason: networkCheck.reason };

239 }

240 return { valid: true };

241}

242// ── 沙箱执行器 ────────────────────────────────────────────────────────

243export class Sandbox {

244 config;

245 _dockerAvailable = null; // 缓存检测结果

246 constructor(config = {}) {

247 this.config = { ...DEFAULT_CONFIG, ...config };

248 }

249 /** 是否应该使用 Docker 沙箱 */

250 shouldUseDocker() {

251 const mode = this.config.useDocker || 'auto';

252 if (mode === 'never')

253 return false;

254 if (mode === 'always')

255 return true;

256 // auto 模式：检测 Docker 是否可用

257 if (this._dockerAvailable === null) {

258 try {

259 const { isDockerAvailable } = require('./sandbox-docker.js');

260 this._dockerAvailable = isDockerAvailable();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/security/sandbox.jsView on unpkg · L258

261 }

262 catch {

263 this._dockerAvailable = false;

264 }

265 }

266 return this._dockerAvailable ?? false;

267 }

268 /**

269 * 在沙箱中执行命令

270 */

271 async execute(command, options) {

272 if (!this.config.enabled) {

273 return this.executeUnsafe(command, options);

274 }

275 const startTime = Date.now();

276 // 验证命令（无论使用哪种沙箱都先验证）

277 const validation = validateCommand(command, this.config);

278 if (!validation.valid) {

lib/security/network-policy.jsView file

Lines 13-53javascript

13 /\bnetcat\s+/,

14 /\bssh\s+/,

15 /\bscp\s+/,

16 /\brsync\s+/,

17 /\bping\s+/,

18 /\btraceroute\s+/,

19 /\bnmap\s+/,

20 /\bhttp\s+/,

21 /\bhttps\s+/,

22];

23// ── SSRF 防护 ─────────────────────────────────────────────────────────

24/** SSRF 防护：检查主机名是否属于内网/私有/危险地址 */

25export function isBlockedSsrfHostname(hostname) {

26 const h = hostname.toLowerCase();

27 return (

28 // Localhost

29 h === 'localhost' ||

30 h === '127.0.0.1' ||

31 h === '::1' ||

32 h === '0.0.0.0' ||

33 h.endsWith('.local') ||

34 // IPv4 private ranges

35 h.startsWith('10.') ||

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/security/network-policy.jsView on unpkg · L33

36 h.startsWith('192.168.') ||

37 /^172\.(1[6-9]|2\d|3[01])\./.test(h) ||

38 // Cloud metadata endpoints (AWS/GCP/Azure)

39 h === '169.254.169.254' ||

40 h === 'metadata.google.internal' ||

41 h === 'metadata.google.com' ||

42 // IPv6 private/link-local ranges

43 /^fd[0-9a-f]{2}:/i.test(h) ||

44 /^fe80:/i.test(h) ||

45 // System-level domain blocklist

46 h.endsWith('.onion') ||

47 h.endsWith('.internal') ||

48 h.endsWith('.localhost'));

49}

50// ── 域名匹配 ──────────────────────────────────────────────────────────

51/** 检查主机名是否匹配域名列表（精确匹配或子域名匹配） */

52export function hostnameMatchesList(hostname, domains) {

53 const h = hostname.toLowerCase();