registry / agent-relay-server / 0.119.2

agent-relay-server@0.119.2

⚠ Under review

Lightweight HTTP message relay for inter-agent communication across machines

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicenseWildcardDependency

scanned 553 file(s), 10.9 MB of source, external domains: 127.0.0.1, api.github.com, cdn.jsdelivr.net, chatgpt.com, github.com, petstore3.swagger.io, radix-ui.com, react.dev, www.apple.com, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 27-67json

27 "scripts/install-bin-shim.cjs",

28 "scripts/orchestrator-spawn-smoke.ts",

29 "runner/src/config.ts",

30 "runner/src/adapter.ts",

31 "runner/plugins/**",

32 "!runner/**/*.test.ts",

33 "public/**",

34 "docs/openapi.json",

35 "README.md",

36 "SECURITY.md",

37 "CONTRIBUTING.md"

38 ],

39 "dependencies": {

40 "agent-relay-channels-host": "0.119.2",

41 "agent-relay-providers": "0.104.2",

42 "agent-relay-sdk": "0.2.104",

43 "ajv": "^8.20.0"

44 },

45 "scripts": {

46 "prepack": "bun run build:claude-monitor >&2 && bun run build:dashboard:bundle >&2",

47 "postinstall": "node scripts/install-bin-shim.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

48 "start": "bun run src/index.ts",

49 "dev": "PUBLIC_DIR=$PWD/public bun --watch run src/index.ts",

50 "dev:dashboard": "cd dashboard && bun run dev",

51 "build:sdk": "cd sdk && bun run build",

52 "build:claude-monitor": "bun run scripts/build-claude-monitor.ts",

53 "build:dashboard": "bun run build:dashboard:bundle && bun run deploy:dashboard",

54 "build:dashboard:bundle": "bun run build:sdk && cd dashboard && bun run build",

55 "deploy:dashboard": "bun run scripts/deploy-dashboard.ts",

56 "test": "bun test",

57 "smoke:spawn": "bun run scripts/orchestrator-spawn-smoke.ts",

58 "publish:smoke": "bun run scripts/publish-smoke.ts",

59 "lint:provider-contract": "bun run scripts/check-provider-contract.ts",

60 "lint:import-boundaries": "bun run scripts/check-import-boundaries.ts",

61 "contract:real-agents": "bun run scripts/provider-contract-real-agents.ts",

62 "contract:real-agents:required": "bun run scripts/provider-contract-real-agents.ts --required",

63 "typecheck": "tsc --noEmit",

64 "docs:api": "bun run scripts/extract-api-spec.ts",

65 "docs:api:check": "bun run scripts/extract-api-spec.ts --check",

66 "release": "bun run scripts/release.ts",

67 "publish:ci": "bun run scripts/publish-ci.ts",

runner/plugins/claude/claude-statusline-probe.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { mkdirSync, renameSync, writeFileSync } = require("node:fs");

5const { tmpdir } = require("node:os");

Medium

Dynamic Require

src/steward.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

3import { stewardFallbackTarget } from "./config";

4import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runner/plugins/claude/monitors/relay-monitor.provisioned.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = agent-relay-server@0.119.0 matchedIdentity = npm:YWdlbnQtcmVsYXktc2VydmVy:0.119.0 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

runner/plugins/claude/monitors/relay-monitor.provisioned.mjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-bin-shim.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

runner/plugins/claude/claude-statusline-probe.cjsView file

3L4: const { mkdirSync, renameSync, writeFileSync } = require("node:fs"); L5: const { tmpdir } = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

runner/plugins/claude/claude-statusline-probe.cjsView on unpkg · L3

src/steward.tsView file

1import { createHash } from "node:crypto"; L2: import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runner/plugins/claude/monitors/relay-monitor.provisioned.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

runner/plugins/claude/monitors/relay-monitor.provisioned.mjsView on unpkg

Findings

1 Critical2 High7 Medium8 Low

CriticalPrevious Version Dangerous Deltarunner/plugins/claude/monitors/relay-monitor.provisioned.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobpublic/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2

MediumDynamic Requirerunner/plugins/claude/claude-statusline-probe.cjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperrunner/plugins/claude/hooks/user-prompt-submit.sh

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptosrc/steward.ts

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

6 flagged

package.jsonView file

Lines 27-67json

27 "scripts/install-bin-shim.cjs",

28 "scripts/orchestrator-spawn-smoke.ts",

29 "runner/src/config.ts",

30 "runner/src/adapter.ts",

31 "runner/plugins/**",

32 "!runner/**/*.test.ts",

33 "public/**",

34 "docs/openapi.json",

35 "README.md",

36 "SECURITY.md",

37 "CONTRIBUTING.md"

38 ],

39 "dependencies": {

40 "agent-relay-channels-host": "0.119.2",

41 "agent-relay-providers": "0.104.2",

42 "agent-relay-sdk": "0.2.104",

43 "ajv": "^8.20.0"

44 },

45 "scripts": {

46 "prepack": "bun run build:claude-monitor >&2 && bun run build:dashboard:bundle >&2",

47 "postinstall": "node scripts/install-bin-shim.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

48 "start": "bun run src/index.ts",

49 "dev": "PUBLIC_DIR=$PWD/public bun --watch run src/index.ts",

50 "dev:dashboard": "cd dashboard && bun run dev",

51 "build:sdk": "cd sdk && bun run build",

52 "build:claude-monitor": "bun run scripts/build-claude-monitor.ts",

53 "build:dashboard": "bun run build:dashboard:bundle && bun run deploy:dashboard",

54 "build:dashboard:bundle": "bun run build:sdk && cd dashboard && bun run build",

55 "deploy:dashboard": "bun run scripts/deploy-dashboard.ts",

56 "test": "bun test",

57 "smoke:spawn": "bun run scripts/orchestrator-spawn-smoke.ts",

58 "publish:smoke": "bun run scripts/publish-smoke.ts",

59 "lint:provider-contract": "bun run scripts/check-provider-contract.ts",

60 "lint:import-boundaries": "bun run scripts/check-import-boundaries.ts",

61 "contract:real-agents": "bun run scripts/provider-contract-real-agents.ts",

62 "contract:real-agents:required": "bun run scripts/provider-contract-real-agents.ts --required",

63 "typecheck": "tsc --noEmit",

64 "docs:api": "bun run scripts/extract-api-spec.ts",

65 "docs:api:check": "bun run scripts/extract-api-spec.ts --check",

66 "release": "bun run scripts/release.ts",

67 "publish:ci": "bun run scripts/publish-ci.ts",

runner/plugins/claude/claude-statusline-probe.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const { mkdirSync, renameSync, writeFileSync } = require("node:fs");

5const { tmpdir } = require("node:os");

Medium

Dynamic Require

src/steward.tsView file

Lines 1-21typescript

1import { createHash } from "node:crypto";

2import { basename, resolve } from "node:path";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/steward.tsView on unpkg · L1

3import { stewardFallbackTarget } from "./config";

4import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";

runner/plugins/claude/hooks/user-prompt-submit.shView file

•path = [redacted]-prompt-submit.sh kind = build_helper sizeBytes = 677 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runner/plugins/claude/hooks/user-prompt-submit.shView on unpkg

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View file

•path = public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2 kind = high_entropy_blob sizeBytes = 15308 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/assets/geist-latin-ext-wght-normal-DMtmJ5ZE.woff2View on unpkg

runner/plugins/claude/monitors/relay-monitor.provisioned.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

runner/plugins/claude/monitors/relay-monitor.provisioned.mjsView on unpkg