registry / agency-lang / 0.9.0
agency-lang@0.9.0
The Agency language
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggeddist/scripts/agency.test.jsView file
4import * as path from "path";
L5: import { execFile } from "child_process";
L6: import { promisify } from "util";
High
Child Process
Package source references child process execution.
dist/scripts/agency.test.jsView on unpkg · L4dist/lib/runtime/ipc.jsView file
349env: { ...process.env, AGENCY_IPC: "1" },
L350: execArgv: [`--max-old-space-size=${memoryMb}`],
L351: ...(args.cwd ? { cwd: args.cwd } : {}),
High
•matchType = previous_version_dangerous_delta
matchedPackage = agency-lang@0.8.1
matchedIdentity = npm:YWdlbmN5LWxhbmc:0.8.1
similarity = 0.833
summary = stored previous version shares package body but lacks this dangerous source file
High
Findings
4 High4 Medium5 Low
HighChild Processdist/scripts/agency.test.js
HighShelldist/lib/runtime/ipc.js
HighSame File Env Network Executiondist/lib/stdlib/oauth.js
HighPrevious Version Dangerous Deltadist/lib/runtime/ipc.js
MediumDynamic Requiredist/lib/optimize/optimizerModule.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/cli/schedule/backends/launchd.js
LowScripts Present
LowEvaldist/lib/ir/prettyPrint.test.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to agency-lang@0.9.0.
See all versions of agency-lang for other recorded verdicts.
- Review the evidence and your use of agency-lang@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.