registry / acptoapi / 1.0.148

acptoapi@1.0.148

⚠ Under review

Anthropic SDK to multi-provider streaming bridge - converts Anthropic message format and tool calls to Gemini, OpenAI-compatible APIs

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 76 file(s), 522 KB of source, external domains: 127.0.0.1, 247420.xyz, aionlabs.ai, aistudio.google.com, api.aionlabs.ai, api.anthropic.com, api.cerebras.ai, api.cloudflare.com, api.cohere.com, api.deepseek.com, api.elevenlabs.io, api.example.com, api.fireworks.ai, api.groq.com, api.llama-api.com, api.mistral.ai, api.openai.com, api.opencode.ai, api.perplexity.ai, api.replicate.com, api.sambanova.ai, api.together.ai, api.together.xyz, api.voyageai.com, api.x.ai, api.z.ai, build.nvidia.com, chatjimmy.ai, cloud.cerebras.ai, cloud.sambanova.ai, codestral.mistral.ai, console.anthropic.com, console.aws.amazon.com, console.groq.com, console.mistral.ai, console.x.ai, dash.cloudflare.com, dashboard.cohere.com, dashscope.aliyuncs.com, dashscope.console.aliyun.com, example.com, fireworks.ai, generativelanguage.googleapis.com, github.com, integrate.api.nvidia.com, my-host.com, ollama.com, opencode.ai, openrouter.ai, platform.deepseek.com

Source & flagged code

6 flagged

bin/acptoapi.jsView file

Lines 103-143javascript

103 }

104 }

105 process.exit(0);

106} else if (args.includes('--probe')) {

107 (async () => {

108 const { listBrands, getBrand } = require('../lib/openai-brands');

109 const checks = [

110 { name: 'ANTHROPIC_API_KEY', set: !!process.env.ANTHROPIC_API_KEY },

111 { name: 'GEMINI_API_KEY', set: !!process.env.GEMINI_API_KEY },

112 { name: 'OLLAMA_URL', set: !!process.env.OLLAMA_URL || true, value: process.env.OLLAMA_URL || 'http://localhost:11434' },

113 { name: 'AWS_ACCESS_KEY_ID', set: !!process.env.AWS_ACCESS_KEY_ID },

114 ];

115 for (const b of listBrands()) {

116 const k = getBrand(b).envKey;

117 checks.push({ name: `${b} (${k})`, set: !!process.env[k] });

118 }

119 for (const c of checks) console.log(`${c.set ? 'OK ' : '-- '} ${c.name}${c.value ? ' = ' + c.value : ''}`);

120 process.exit(0);

121 })();

122} else if (args.includes('--update')) {

123 (async () => {

124 const { execSync } = require('child_process');

125 const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L123

126 const tryRun = (cmd) => { try { execSync(cmd, opts); return true; } catch { return false; } };

127 console.log('[acptoapi] clearing npx + bun caches and re-fetching @latest...');

128 tryRun('npm cache clean --force');

129 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\npm-cache\\_npx" 2>nul' : 'rm -rf ~/.npm/_npx');

130 tryRun(process.platform === 'win32' ? 'rmdir /s /q "%LOCALAPPDATA%\\..\\Roaming\\npm-cache\\_npx" 2>nul' : 'true');

131 tryRun('bun pm cache rm');

132 const latest = (() => { try { return require('child_process').execSync('npm view acptoapi version', { windowsHide: true }).toString().trim(); } catch { return '(unknown)'; } })();

133 console.log(`[acptoapi] latest on npm: ${latest}`);

134 console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.');

135 process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L123

136 })();

137} else if (args.includes('--list-brands')) {

138 const { listBrands } = require('../lib/openai-brands');

139 for (const b of listBrands()) console.log(b);

140 process.exit(0);

141} else if (args.includes('--list-chains')) {

142 const { listNamedChains, resolveNamedChain } = require('../lib/chain');

143 const names = listNamedChains();

•matchType = previous_version_dangerous_delta matchedPackage = acptoapi@1.0.126 matchedIdentity = npm:YWNwdG9hcGk:1.0.126 similarity = 0.770 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/acptoapi.jsView on unpkg

test.jsView file

Lines 1-35javascript

1'use strict';

2// Integration witness: chain selection, named chains, fallthrough, sampler backoff,

3// real-backend chain fallback, key rotation, format translation, edge cases.

4// Mock-free - NO stub HTTP, NO monkey-patching of sdk.chat/stream. Routing/format

5// logic is exercised directly; live-dispatch dimensions (single model, comma-chain,

6// queue, chain fallback, openai->anthropic translation) are witnessed against a REAL

7// local OpenAI-compatible SSE server bound to a real socket (same pattern as the

8// kilo/opencode ACP daemons - a genuine HTTP backend, not a mock provider).

10// Disabled globally, before any lib/server.js require: real ACP daemon

11// autolaunch (kilo/opencode/qwen-code/...) spawns real child processes with

index.jsView file

Lines 102-142javascript

102const { getFormat, FORMATS } = require('./lib/formats/index');

103const { getProvider, PROVIDERS } = require('./lib/providers/index');

104const { createStreamActor } = require('./lib/machine');

105const

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

Source & flagged code

6 flagged · loading source

bin/acptoapi.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/acptoapi.jsView on unpkg

123(async () => { L124: const { execSync } = require('child_process'); L125: const opts = { stdio: 'inherit', windowsHide: true };

High

Child Process

Package source references child process execution.

bin/acptoapi.jsView on unpkg · L123

123(async () => { L124: const { execSync } = require('child_process'); L125: const opts = { stdio: 'inherit', windowsHide: true }; ... L133: console.log(`[acptoapi] latest on npm: ${latest}`); L134: console.log('[acptoapi] next invocation of `bunx acptoapi@latest` or `npx -y acptoapi@latest` will fetch fresh.'); L135: process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/acptoapi.jsView on unpkg · L123

test.jsView file

15L16: const assert = require('assert'); L17: const http = require('http');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

test.jsView on unpkg · L15

index.jsView file

122async function runClaude(opts = {}) { L123: const { spawn } = require('child_process'); L124: const http = require('http'); L125: const { execSync } = require('child_process'); ... L127: const baseUrl = `http://127.0.0.1:${port}`; L128: const apiKey = process.env.ACPTOAPI_API_KEY || 'theultimateflex'; L129:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L122

install-acp-agents.ps1View file

•path = install-acp-agents.ps1 kind = build_helper sizeBytes = 2879 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-acp-agents.ps1View on unpkg

Findings

1 Critical4 High5 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/acptoapi.js

HighChild Processbin/acptoapi.js

HighShell

HighSame File Env Network Executionindex.js

HighRuntime Package Installbin/acptoapi.js

MediumDynamic Requiretest.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-acp-agents.ps1

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings