registry / acptoapi / 1.0.131

acptoapi@1.0.131

⚠ Under review

Anthropic SDK to multi-provider streaming bridge - converts Anthropic message format and tool calls to Gemini, OpenAI-compatible APIs

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 439 KB of source, external domains: 127.0.0.1, 247420.xyz, api.anthropic.com, api.cerebras.ai, api.cloudflare.com, api.cohere.com, api.deepseek.com, api.elevenlabs.io, api.fireworks.ai, api.groq.com, api.llama-api.com, api.mistral.ai, api.openai.com, api.opencode.ai, api.perplexity.ai, api.replicate.com, api.sambanova.ai, api.together.xyz, api.voyageai.com, api.x.ai, api.z.ai, chatjimmy.ai, codestral.mistral.ai, dashscope.aliyuncs.com, example.com, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, openrouter.ai, schema.org, unpkg.com, upload.wikimedia.org, www.w3.org

Source & flagged code

6 flagged

bin/acptoapi.jsView file

Lines 44-84javascript

44if (opencodeBase) backends.opencode = { base: opencodeBase };

45if (claudeBase) backends.claude = { base: claudeBase };

47if (args.includes('--probe')) {

48 (async () => {

49 const { listBrands, getBrand } = require('../lib/openai-brands');

50 const checks = [

51 { name: 'ANTHROPIC_API_KEY', set: !!process.env.ANTHROPIC_API_KEY },

52 { name: 'GEMINI_API_KEY', set: !!process.env.GEMINI_API_KEY },

53 { name: 'OLLAMA_URL', set: !!process.env.OLLAMA_URL || true, value: process.env.OLLAMA_URL || 'http://localhost:11434' },

54 { name: 'AWS_ACCESS_KEY_ID', set: !!process.env.AWS_ACCESS_KEY_ID },

55 ];

56 for (const b of listBrands()) {

57 const k = getBrand(b).envKey;

58 checks.push({ name: `${b} (${k})`, set: !!process.env[k] });

59 }

60 for (const c of checks) console.log(`${c.set ? 'OK ' : '-- '} ${c.name}${c.value ? ' = ' + c.value : ''}`);

61 process.exit(0);

62 })();

63} else if (args.includes('--update')) {

64 (async () => {

65 const { execSync } = require('child_process');

66 const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L64

67 const tryRun = (cmd) => { try { execSync(cmd, opts); return true; } catch { return false; } };

68 console.log('[acptoapi] clearing npx + bun caches and re-fetching @latest...');

69 tryRun('npm cache clean --force');

70 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\npm-cache\\_npx" 2>nul' : 'rm -rf ~/.npm/_npx');

71 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\..\\Roaming\\npm-cache\\_npx" 2>nul' : 'true');

72 tryRun('bun pm cache rm');

73 const latest = (() => { try { return require('child_process').execSync('npm view acptoapi version', { windowsHide: true }).toString().trim(); } catch { return '(unknown)'; } })();

74 console.log(`[acptoapi] latest on npm: ${latest}`);

75 console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.');

76 process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L64

77 })();

78} else if (args.includes('--list-brands')) {

79 const { listBrands } = require('../lib/openai-brands');

80 for (const b of listBrands()) console.log(b);

81 process.exit(0);

82} else if (args.includes('--list-chains')) {

83 const { listNamedChains, resolveNamedChain } = require('../lib/chain');

84 const names = listNamedChains();

•matchType = previous_version_dangerous_delta matchedPackage = acptoapi@1.0.126 matchedIdentity = npm:YWNwdG9hcGk:1.0.126 similarity = 0.851 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/acptoapi.jsView on unpkg

test.jsView file

Lines 1-35javascript

1'use strict';

2// Integration witness: chain selection, named chains, fallthrough, sampler backoff,

3// real-backend chain fallback, key rotation, format translation, edge cases.

4// Mock-free - NO stub HTTP, NO monkey-patching of sdk.chat/stream. Routing/format

5// logic is exercised directly; live-dispatch dimensions (single model, comma-chain,

6// queue, chain fallback, openai->anthropic translation) are witnessed against a REAL

7// local OpenAI-compatible SSE server bound to a real socket (same pattern as the

8// kilo/opencode ACP daemons - a genuine HTTP backend, not a mock provider).

10// Disabled globally, before any lib/server.js require: real ACP daemon

11// autolaunch (kilo/opencode/qwen-code/...) spawns real child processes with

index.jsView file

Lines 101-141javascript

101const { translate, translateSync, buffer, stream } = require('./lib/translate');

102const { getFormat, FORMATS } = require('./lib/formats/index');

103const { getProvider, PROVIDERS } = require

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

Source & flagged code

6 flagged · loading source

bin/acptoapi.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/acptoapi.jsView on unpkg

64(async () => { L65: const { execSync } = require('child_process'); L66: const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L64

64(async () => { L65: const { execSync } = require('child_process'); L66: const opts = { stdio: 'inherit', windowsHide: true }; ... L74: console.log(`[acptoapi] latest on npm: ${latest}`); L75: console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.'); L76: process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L64

test.jsView file

15L16: const assert = require('assert'); L17: const http = require('http');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

test.jsView on unpkg · L15

index.jsView file

121async function runClaude(opts = {}) { L122: const { spawn } = require('child_process'); L123: const http = require('http'); L124: const { execSync } = require('child_process'); ... L126: const baseUrl = `http://127.0.0.1:${port}`; L127: const apiKey = process.env.ACPTOAPI_API_KEY || 'theultimateflex'; L128:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L121

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

Findings

1 Critical4 High5 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/acptoapi.js

HighChild Processbin/acptoapi.js

HighShell

HighSame File Env Network Executionindex.js

HighRuntime Package Installbin/acptoapi.js

MediumDynamic Requiretest.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-acp-agents.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings