registry / acptoapi / 1.0.129

acptoapi@1.0.129

⚠ Under review

Anthropic SDK to multi-provider streaming bridge - converts Anthropic message format and tool calls to Gemini, OpenAI-compatible APIs

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 422 KB of source, external domains: 127.0.0.1, 247420.xyz, api.anthropic.com, api.cerebras.ai, api.cloudflare.com, api.cohere.com, api.deepseek.com, api.elevenlabs.io, api.fireworks.ai, api.groq.com, api.llama-api.com, api.mistral.ai, api.openai.com, api.opencode.ai, api.perplexity.ai, api.replicate.com, api.sambanova.ai, api.together.xyz, api.voyageai.com, api.x.ai, api.z.ai, chatjimmy.ai, codestral.mistral.ai, dashscope.aliyuncs.com, example.com, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, openrouter.ai, schema.org, unpkg.com, upload.wikimedia.org, www.w3.org

Source & flagged code

5 flagged

bin/acptoapi.jsView file

Lines 25-65javascript

25if (kiloBase) backends.kilo = { base: kiloBase };

26if (opencodeBase) backends.opencode = { base: opencodeBase };

28if (args.includes('--probe')) {

29 (async () => {

30 const { listBrands, getBrand } = require('../lib/openai-brands');

31 const checks = [

32 { name: 'ANTHROPIC_API_KEY', set: !!process.env.ANTHROPIC_API_KEY },

33 { name: 'GEMINI_API_KEY', set: !!process.env.GEMINI_API_KEY },

34 { name: 'OLLAMA_URL', set: !!process.env.OLLAMA_URL || true, value: process.env.OLLAMA_URL || 'http://localhost:11434' },

35 { name: 'AWS_ACCESS_KEY_ID', set: !!process.env.AWS_ACCESS_KEY_ID },

36 ];

37 for (const b of listBrands()) {

38 const k = getBrand(b).envKey;

39 checks.push({ name: `${b} (${k})`, set: !!process.env[k] });

40 }

41 for (const c of checks) console.log(`${c.set ? 'OK ' : '-- '} ${c.name}${c.value ? ' = ' + c.value : ''}`);

42 process.exit(0);

43 })();

44} else if (args.includes('--update')) {

45 (async () => {

46 const { execSync } = require('child_process');

47 const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L45

48 const tryRun = (cmd) => { try { execSync(cmd, opts); return true; } catch { return false; } };

49 console.log('[acptoapi] clearing npx + bun caches and re-fetching @latest...');

50 tryRun('npm cache clean --force');

51 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\npm-cache\\_npx" 2>nul' : 'rm -rf ~/.npm/_npx');

52 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\..\\Roaming\\npm-cache\\_npx" 2>nul' : 'true');

53 tryRun('bun pm cache rm');

54 const latest = (() => { try { return require('child_process').execSync('npm view acptoapi version', { windowsHide: true }).toString().trim(); } catch { return '(unknown)'; } })();

55 console.log(`[acptoapi] latest on npm: ${latest}`);

56 console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.');

57 process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L45

58 })();

59} else if (args.includes('--list-brands')) {

60 const { listBrands } = require('../lib/openai-brands');

61 for (const b of listBrands()) console.log(b);

62 process.exit(0);

63} else if (args.includes('--list-chains')) {

64 const { listNamedChains, resolveNamedChain } = require('../lib/chain');

65 const names = listNamedChains();

test.jsView file

Lines 1-29javascript

1'use strict';

2// Integration witness: chain selection, named chains, fallthrough, sampler backoff,

3// real-backend chain fallback, key rotation, format translation, edge cases.

4// Mock-free - NO stub HTTP, NO monkey-patching of sdk.chat/stream. Routing/format

5// logic is exercised directly; live-dispatch dimensions (single model, comma-chain,

6// queue, chain fallback, openai->anthropic translation) are witnessed against a REAL

7// local OpenAI-compatible SSE server bound to a real socket (same pattern as the

8// kilo/opencode ACP daemons - a genuine HTTP backend, not a mock provider).

10const assert =

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

lib/auto-chain.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = acptoapi@1.0.126 matchedIdentity = npm:YWNwdG9hcGk:1.0.126 similarity = 0.973 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

lib/auto-chain.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/acptoapi.jsView file

45(async () => { L46: const { execSync } = require('child_process'); L47: const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L45

45(async () => { L46: const { execSync } = require('child_process'); L47: const opts = { stdio: 'inherit', windowsHide: true }; ... L55: console.log(`[acptoapi] latest on npm: ${latest}`); L56: console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.'); L57: process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L45

test.jsView file

9L10: const assert = require('assert'); L11: const http = require('http');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

test.jsView on unpkg · L9

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

lib/auto-chain.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

lib/auto-chain.jsView on unpkg

Findings

1 Critical3 High5 Medium3 Low

CriticalPrevious Version Dangerous Deltalib/auto-chain.js

HighChild Processbin/acptoapi.js

HighShell

HighRuntime Package Installbin/acptoapi.js

MediumDynamic Requiretest.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-acp-agents.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/acptoapi.jsView file

Lines 25-65javascript

25if (kiloBase) backends.kilo = { base: kiloBase };

26if (opencodeBase) backends.opencode = { base: opencodeBase };

28if (args.includes('--probe')) {

29 (async () => {

30 const { listBrands, getBrand } = require('../lib/openai-brands');

31 const checks = [

32 { name: 'ANTHROPIC_API_KEY', set: !!process.env.ANTHROPIC_API_KEY },

33 { name: 'GEMINI_API_KEY', set: !!process.env.GEMINI_API_KEY },

34 { name: 'OLLAMA_URL', set: !!process.env.OLLAMA_URL || true, value: process.env.OLLAMA_URL || 'http://localhost:11434' },

35 { name: 'AWS_ACCESS_KEY_ID', set: !!process.env.AWS_ACCESS_KEY_ID },

36 ];

37 for (const b of listBrands()) {

38 const k = getBrand(b).envKey;

39 checks.push({ name: `${b} (${k})`, set: !!process.env[k] });

40 }

41 for (const c of checks) console.log(`${c.set ? 'OK ' : '-- '} ${c.name}${c.value ? ' = ' + c.value : ''}`);

42 process.exit(0);

43 })();

44} else if (args.includes('--update')) {

45 (async () => {

46 const { execSync } = require('child_process');

47 const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L45

48 const tryRun = (cmd) => { try { execSync(cmd, opts); return true; } catch { return false; } };

49 console.log('[acptoapi] clearing npx + bun caches and re-fetching @latest...');

50 tryRun('npm cache clean --force');

51 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\npm-cache\\_npx" 2>nul' : 'rm -rf ~/.npm/_npx');

52 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\..\\Roaming\\npm-cache\\_npx" 2>nul' : 'true');

53 tryRun('bun pm cache rm');

54 const latest = (() => { try { return require('child_process').execSync('npm view acptoapi version', { windowsHide: true }).toString().trim(); } catch { return '(unknown)'; } })();

55 console.log(`[acptoapi] latest on npm: ${latest}`);

56 console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.');

57 process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L45

58 })();

59} else if (args.includes('--list-brands')) {

60 const { listBrands } = require('../lib/openai-brands');

61 for (const b of listBrands()) console.log(b);

62 process.exit(0);

63} else if (args.includes('--list-chains')) {

64 const { listNamedChains, resolveNamedChain } = require('../lib/chain');

65 const names = listNamedChains();

test.jsView file

Lines 1-29javascript

1'use strict';

2// Integration witness: chain selection, named chains, fallthrough, sampler backoff,

3// real-backend chain fallback, key rotation, format translation, edge cases.

4// Mock-free - NO stub HTTP, NO monkey-patching of sdk.chat/stream. Routing/format

5// logic is exercised directly; live-dispatch dimensions (single model, comma-chain,

6// queue, chain fallback, openai->anthropic translation) are witnessed against a REAL

7// local OpenAI-compatible SSE server bound to a real socket (same pattern as the

8// kilo/opencode ACP daemons - a genuine HTTP backend, not a mock provider).

10const assert =

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

lib/auto-chain.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

lib/auto-chain.jsView on unpkg