registry / agent-relay-server / 0.118.4

agent-relay-server@0.118.4

Lightweight HTTP message relay for inter-agent communication across machines

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 551 file(s), 10.9 MB of source, external domains: 127.0.0.1, api.github.com, cdn.jsdelivr.net, chatgpt.com, github.com, petstore3.swagger.io, radix-ui.com, react.dev, www.apple.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 26-66json

26 "scripts/install-bin-shim.cjs",

27 "scripts/orchestrator-spawn-smoke.ts",

28 "runner/src/config.ts",

29 "runner/src/adapter.ts",

30 "runner/plugins/**",

31 "!runner/**/*.test.ts",

32 "public/**",

33 "docs/openapi.json",

34 "README.md",

35 "SECURITY.md",

36 "CONTRIBUTING.md"

37 ],

38 "dependencies": {

39 "agent-relay-channels-host": "0.118.4",

40 "agent-relay-providers": "0.104.1",

41 "agent-relay-sdk": "0.2.101",

42 "ajv": "^8.20.0"

43 },

44 "scripts": {

45 "prepack": "bun run build:claude-monitor >&2 && bun run build:dashboard:bundle >&2",

46 "postinstall": "node scripts/install-bin-shim.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

47 "start": "bun run src/index.ts",

48 "dev": "PUBLIC_DIR=$PWD/public bun --watch run src/index.ts",

49 "dev:dashboard": "cd dashboard && bun run dev",

50 "build:sdk": "cd sdk && bun run build",

51 "build:claude-monitor": "bun run scripts/build-claude-monitor.ts",

52 "build:dashboard": "bun run build:dashboard:bundle && bun run deploy:dashboard",

53 "build:dashboard:bundle": "bun run build:sdk && cd dashboard && bun run build",

54 "deploy:dashboard": "bun run scripts/deploy-dashboard.ts",

55 "test": "bun test",

56 "smoke:spawn": "bun run scripts/orchestrator-spawn-smoke.ts",

57 "publish:smoke": "bun run scripts/publish-smoke.ts",

58 "lint:provider-contract": "bun run scripts/check-provider-contract.ts",

59 "lint:import-boundaries": "bun run scripts/check-import-boundaries.ts",

60 "contract:real-agents": "bun run scripts/provider-contract-real-agents.ts",

61 "contract:real-agents:required": "bun run scripts/provider-contract-real-agents.ts --required",

62 "typecheck": "tsc --noEmit",

63 "docs:api": "bun run scripts/extract-api-spec.ts",

64 "docs:api:check": "bun run scripts/extract-api-spec.ts --check",

65 "release": "bun run scripts/release.ts",

66 "publish:ci": "bun run scripts/publish-ci.ts",

public/assets/javascript-jsk4-ryD.jsView file

Lines 1-2javascript

1import{n as e}from"./chunk-CilyBKbf.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse(`{"displayName":"JavaScript","name":"javascript","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![$_[:alnum:]])(?:(?<=\\\\.\\\\.\\\\.)|(?<!\\\\.))(abstract|declare|override|public|protected|private|readonly|static)(?![$_[:alnum:]])(?:(?=\\\\.\\\\

src/steward.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

3import { stewardFallbackTarget } from "./config";

4import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-bin-shim.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

public/assets/javascript-jsk4-ryD.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

public/assets/javascript-jsk4-ryD.jsView on unpkg · L1

src/steward.tsView file

1import { createHash } from "node:crypto"; L2: import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

Findings

2 High7 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobpublic/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2

MediumDynamic Requirepublic/assets/javascript-jsk4-ryD.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperrunner/plugins/claude/hooks/user-prompt-submit.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptosrc/steward.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

5 flagged

package.jsonView file

Lines 26-66json

26 "scripts/install-bin-shim.cjs",

27 "scripts/orchestrator-spawn-smoke.ts",

28 "runner/src/config.ts",

29 "runner/src/adapter.ts",

30 "runner/plugins/**",

31 "!runner/**/*.test.ts",

32 "public/**",

33 "docs/openapi.json",

34 "README.md",

35 "SECURITY.md",

36 "CONTRIBUTING.md"

37 ],

38 "dependencies": {

39 "agent-relay-channels-host": "0.118.4",

40 "agent-relay-providers": "0.104.1",

41 "agent-relay-sdk": "0.2.101",

42 "ajv": "^8.20.0"

43 },

44 "scripts": {

45 "prepack": "bun run build:claude-monitor >&2 && bun run build:dashboard:bundle >&2",

46 "postinstall": "node scripts/install-bin-shim.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

47 "start": "bun run src/index.ts",

48 "dev": "PUBLIC_DIR=$PWD/public bun --watch run src/index.ts",

49 "dev:dashboard": "cd dashboard && bun run dev",

50 "build:sdk": "cd sdk && bun run build",

51 "build:claude-monitor": "bun run scripts/build-claude-monitor.ts",

52 "build:dashboard": "bun run build:dashboard:bundle && bun run deploy:dashboard",

53 "build:dashboard:bundle": "bun run build:sdk && cd dashboard && bun run build",

54 "deploy:dashboard": "bun run scripts/deploy-dashboard.ts",

55 "test": "bun test",

56 "smoke:spawn": "bun run scripts/orchestrator-spawn-smoke.ts",

57 "publish:smoke": "bun run scripts/publish-smoke.ts",

58 "lint:provider-contract": "bun run scripts/check-provider-contract.ts",

59 "lint:import-boundaries": "bun run scripts/check-import-boundaries.ts",

60 "contract:real-agents": "bun run scripts/provider-contract-real-agents.ts",

61 "contract:real-agents:required": "bun run scripts/provider-contract-real-agents.ts --required",

62 "typecheck": "tsc --noEmit",

63 "docs:api": "bun run scripts/extract-api-spec.ts",

64 "docs:api:check": "bun run scripts/extract-api-spec.ts --check",

65 "release": "bun run scripts/release.ts",

66 "publish:ci": "bun run scripts/publish-ci.ts",

public/assets/javascript-jsk4-ryD.jsView file

Lines 1-2javascript

src/steward.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

3import { stewardFallbackTarget } from "./config";

4import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg